Advisories · Technology
MongoDB libmongocrypt.
Every CVE that names MongoDB libmongocrypt among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.0 Medium
KMS request injection via unsanitized key vault and provider values in libmongocrypt
- MongoDB libmongocrypt
- Other injection
- CVSS 5.3 Medium
Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt
- MongoDB libmongocrypt
- CWE-354
- CVSS 8.7 High
Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt
- MongoDB libmongocrypt
- Memory corruption
- CVSS 7.1 High
Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt
- MongoDB libmongocrypt
- Memory corruption
- CVSS 5.7 Medium
Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
- MongoDB libmongocrypt
- Other injection
- CVSS 7.1 High
Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path
- MongoDB libmongocrypt
- Denial of service
- CVSS 2.0 Low
Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
- MongoDB libmongocrypt
- Other injection