Executive brief
A vulnerability in MongoDB Server's encryption library allows an authenticated user to crash the database service. By sending a specially crafted database command, an attacker can force the system to exhaust its available memory, leading to a denial-of-service. This impacts business operations by making data unavailable to applications and users until the service is restarted.
Technical details
A denial-of-service vulnerability exists in MongoDB's libmongocrypt library due to insufficient validation of payload-supplied values. Specifically, the FLE2IndexedTextEncryptedValue constructor fails to enforce tag limits during buffer parsing, unlike the insertion path. An attacker with network access and standard read/write privileges can provide a crafted aggregation command containing a large 'edge_count' value. This triggers an integer overflow or an excessively large memory allocation in the mc_FLE2IndexedEncryptedValueV2_parse function, leading to a process crash (OOM). The issue is addressed in versions 8.2.12, 8.3.7, and 9.0.0-rc1.
Affected products
- MongoDB MongoDB Server 8.2.0 to 8.2.11, 8.3.0 to 8.3.6
Timeline
- 2026-05-27: other: Vulnerability reported internally/created in Jira
- 2026-07-22: disclosed: CVE published