CVE-2026-88032: Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires use of the MongoDB Java Driver's reactive client-side encryption component with an affected configuration that retrieves KMS credentials on demand. Deployments not using that combination are not described as reaching the issue.
What must an attacker be able to do to trigger the denial of service?
A party must be able to cause an affected encrypted operation to be cancelled while it is still using native resources. Successful exploitation can terminate the hosting application process.
What is the impact if exploitation succeeds?
The documented impact is application denial of service: the hosting application process may terminate. No confidentiality or integrity impact is stated.