Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-106434 EUVD-2026-95163

Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt

Published Oct 8, 2026 · Updated Oct 8, 2026 · Assigned by mongodb

Description

The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.

Affected products

VendorProductAffectedFixed
MongoDB libmongocrypt 1.5.0 – < 1.20.5 1.20.5

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libmongocrypt 1.20.5-1 —
Debian 13 libmongocrypt No fix yet —
Debian 12 libmongocrypt No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libmongocrypt No fix yet —
Ubuntu 26.04 LTS libmongocrypt No fix yet —
Ubuntu 24.04 LTS libmongocrypt No fix yet —
Ubuntu 22.04 LTS libmongocrypt No fix yet —

Advisories 1

References