CVE-2026-84971CWE-617

CVE-2026-84971

Medium · published September 3, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
16.7
In the wild
Unconfirmed
What it is

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00259 · 16.7th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2026-09-03T19:17Z
Affected products (1)
ProductVersionsFixed in
mongodb/libmongocrypt≥ 1.7.0, < 1.20.41.20.4
References (1)
https://jira.mongodb.org/browse/MONGOCRYPT-971 · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 14:57Z
    Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path
    cvelistv5