4.3Orta
CVE-2026-106434Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt
Açıklama
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.
Zayıflık türü (CWE):
CWE-354
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| MongoDB | libmongocrypt | 1.5.0 – < 1.20.5 |