Log in Start free

Vulnerability · Published Sep 10, 2026 · Assigned by mongodb

CVE-2026-88032Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver

Medium 5.9

In plain English

A medium-severity use-after-free in Java Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 82.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mongo-java-driverno fix listedDEBIAN-CVE-2026-88032
Debian:13mongo-java-driverno fix listedDEBIAN-CVE-2026-88032
Debian:14mongo-java-driverno fix listedDEBIAN-CVE-2026-88032
Ubuntu:22.04:LTSmongo-java-driverno fix listedUBUNTU-CVE-2026-88032
Ubuntu:24.04:LTSmongo-java-driverno fix listedUBUNTU-CVE-2026-88032
Ubuntu:26.04:LTSmongo-java-driverno fix listedUBUNTU-CVE-2026-88032
Ubuntu:26.10mongo-java-driverno fix listedUBUNTU-CVE-2026-88032

Affected products (as reported)

VendorProductVersions
MongoDB Java Driver 4.2.0 – before 5.11.1
MongoDB org.mongodb:mongodb-crypt Maven package 1.4.0 – before 5.11.1
MongoDB org.mongodb:mongodb-driver-reactivestreams Maven package 4.6.0 – before 5.11.1

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References