CVE-2026-106429: MongoDB Libmongocrypt

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.

Affected products

• MongoDB Libmongocrypt: from 1.1.0, before 1.20.5 (fixed in 1.20.5)

Published 2026-10-08. Last modified 2026-10-08.