# CVE-2026-84971: MongoDB libmongocrypt denial of service via undersized encrypted payload

Source: https://junglewise.ai/threats/cve-2026-84971-mongodb-libmongocrypt-denial-of-service-via-undersized-encrypted  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84971 · Severity: medium · CVSS 6.5 · Published 2026-09-03

MongoDB's libmongocrypt is a client-side encryption library that handles encrypted data decryption in database applications. An attacker who can inject a malformed encrypted value into the decryption path can trigger an internal validation failure that crashes the application, causing a denial of service. This could disrupt business operations for applications relying on MongoDB's encrypted field functionality.

Technologies: [MongoDB Libmongocrypt](https://junglewise.ai/threats/technologies/libmongocrypt). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-84971 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84971 being exploited in the wild.

**How severe is CVE-2026-84971?** Medium severity, with a CVSS score of 6.5, published 3 September 2026.

**Which products and versions are affected?** MongoDB Libmongocrypt before 1.20.4.

**Is there a fix for CVE-2026-84971?** A patch was published on 2026-09-03: Fixed in version 1.20.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84971 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84971?** Check whether you run MongoDB Libmongocrypt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a client-side denial of service flaw in the decryption path of libmongocrypt caused by improper handling of unexpectedly small (undersized) encrypted payload values. When the library attempts to decrypt a malformed payload with insufficient data, it fails an internal validation check and aborts the process. An attacker with the ability to place a crafted encrypted value where an application will decrypt it, or control network responses, can trigger this abort condition. The issue was fixed in version 1.20.4 of libmongocrypt.

## Affected products

- MongoDB libmongocrypt before 1.20.4

## Timeline

- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 1.20.4

## References

- [https://jira.mongodb.org/browse/MONGOCRYPT-971](https://jira.mongodb.org/browse/MONGOCRYPT-971)

## Related threats

- [libmongocrypt out-of-bounds write in key-management request builder](https://junglewise.ai/threats/cve-2026-126792-a-memory-safety-flaw-in-the-key-management-request-building)
- [libmongocrypt KMS request injection in key vault processing](https://junglewise.ai/threats/cve-2026-114655-libmongocrypt-builds-requests-to-external-key-management)
- [MongoDB libmongocrypt state management memory corruption](https://junglewise.ai/threats/cve-2026-106433-improper-state-management-in-mongodb-libmongocrypt-can-cause)
- [MongoDB Crypt key vault privilege escalation to Google Cloud KMS](https://junglewise.ai/threats/cve-2026-84962-mongodb-crypt-key-vault-privilege-escalation-to-google-cloud-kms)
- [MongoDB libmongocrypt input validation bypass in automatic encryption](https://junglewise.ai/threats/cve-2026-81523-mongodb-libmongocrypt-input-validation-bypass-in-automatic)