CVE-2026-88032: MongoDB Java Driver use-after-free in reactive encryption

CVE-2026-88032 · Severity: medium · CVSS 5.9 · Published 2026-09-10

The MongoDB Java Driver's client-side encryption feature can crash an application when an encrypted database operation is cancelled (due to network timeout or client disconnect). When cancellation occurs during credential fetching, native memory is freed prematurely while still in use, causing the application process to terminate or potentially corrupt encryption key storage. This affects applications using reactive (async) database connections with on-demand KMS credential fetching.

Technologies: MongoDB Java Driver. Vendors: MongoDB.

Quick answers

Is CVE-2026-88032 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88032 being exploited in the wild.
How severe is CVE-2026-88032?
Medium severity, with a CVSS score of 5.9, published 10 September 2026.
Which products and versions are affected?
MongoDB Java Driver before 5.11.1.
Is there a fix for CVE-2026-88032?
A patch was published on 2026-09-10: Fixed in MongoDB Java Driver 5.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88032 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-88032?
Check whether you run MongoDB Java Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a use-after-free in the reactive client-side encryption component (libmongocrypt) arising from a race condition between the cancellation path and in-flight encryption state-machine operations. When an operation is cancelled, the driver frees the native libmongocrypt context from a finally block without synchronization, while another thread may still be executing a state-machine step that accesses the same context. The root cause is missing locking around native context calls and improper ordering of resource cleanup. Exploitation requires a reactive encryption configuration with on-demand KMS credential supply (via kmsProviderPropertySupplier). The impact is process termination or memory corruption affecting encryption key material. MongoDB Java Driver versions prior to 5.11.1 are affected; the fix introduces proper synchronization via locking around native calls and close() operations.

Affected products

  • MongoDB Java Driver before 5.11.1

Timeline

  • 2026-09-10: disclosed: CVE-2026-88032 published
  • 2026-09-10: patched: Fixed in MongoDB Java Driver 5.11.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.