Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-88032 EUVD-2026-75668GHSA-38pq-38pp-9f4m

Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver

Published Sep 10, 2026 · Updated Sep 10, 2026 · Assigned by mongodb

Description

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

Affected products

VendorProductAffectedFixed
MongoDB Java Driver 4.2.0 – < 5.11.1 5.11.1
MongoDB org.mongodb:mongodb-crypt Maven package 1.4.0 – < 5.11.1 5.11.1
MongoDB org.mongodb:mongodb-driver-reactivestreams Maven package 4.6.0 – < 5.11.1 5.11.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 mongo-java-driver No fix yet —
Debian 13 mongo-java-driver No fix yet —
Debian 12 mongo-java-driver No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 mongo-java-driver No fix yet —
Ubuntu 26.04 LTS mongo-java-driver No fix yet —
Ubuntu 24.04 LTS mongo-java-driver No fix yet —
Ubuntu 22.04 LTS mongo-java-driver No fix yet —
Ubuntu 20.04 LTS mongo-java-driver No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS mongo-java-driver No fix yet —
Ubuntu 16.04 LTS mongo-java-driver No fix yet —

Advisories 1

References