redhat/mongodb-crypt vulnerabilities

Latest redhat/mongodb-crypt CVEs

Newest publication first

1. CVE-2026-88032 Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver

   Published 2026-09-10

   High·CVSS 8.2 EPSS 0.26%

   A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled m...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.