CVE-2026-84971: Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path
Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using the affected client-side encryption library are exposed when they decrypt encrypted values that an attacker can place in the application's data path, or when an attacker can control responses received by the application.
What does an attacker need to exploit this issue?
The attacker needs the ability to supply a suitably formed encrypted value that the application will attempt to decrypt, or to control the application's received responses. The supplied value must have an unexpected undersized ciphertext length.
What is the expected impact of successful exploitation?
Successful exploitation terminates the process using the library, causing an availability impact. The provided severity data indicates no confidentiality or integrity impact.