CVE-2026-106429 Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt
An integer underflow in libmongocrypt allows an authenticated user to cause a denial of service by triggering an allocation failure via malformed KMS endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106429?
CVE-2026-106429 is a high-severity vulnerability in MongoDB libmongocrypt, published on 8 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.
Weakness: CWE-191
Which versions are affected by CVE-2026-106429?
How do I fix CVE-2026-106429?
Upgrade to a fixed version.
Is CVE-2026-106429 being exploited?
There is no known exploitation of CVE-2026-106429 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-106429, UBUNTU-CVE-2026-106429.