Libmongocrypt
Approved changes feed: RSS · Atom
cpe:2.3:a:mongodb:libmongocrypt:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Mongodb (1aa156a6-63a9-5032-baaf-10197d408a1e) |
|---|---|
| Product | Libmongocrypt (f6d7d1f6-0fa0-57ca-9e88-fb750cc312d1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/libmongocrypt |
purl2cpe | 2026-06-01 10:11:17.248122 |
pkg:deb/ubuntu/libmongocrypt |
purl2cpe | 2026-06-01 10:11:17.248125 |
pkg:github/mongodb/libmongocrypt |
purl2cpe | 2026-06-01 10:11:17.248127 |
pkg:npm/mongodb-client-encryption |
purl2cpe | 2026-06-01 10:11:17.248130 |
pkg:rpm/fedora/libmongocrypt |
purl2cpe | 2026-06-01 10:11:17.248133 |
pkg:rpm/opensuse/libmongocrypt |
purl2cpe | 2026-06-01 10:11:17.248136 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-114655 |
vulnerable | 2026-11-03 10:15:53.291533 |
KMS request injection via unsanitized key vault and provider values in libmongocrypt
MEDIUM (5.9)
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.
Published: 2026-10-22T19:14:00.708Z
Updated: 2026-10-30T19:30:19.252Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.