CVE-2026-84971

CVE-2026-84971 is a denial-of-service flaw (CWE-617, reachable assertion) in MongoDB's client-side encryption library, where the decryption path mishandles an unexpectedly large value size and trips an internal check that terminates the process using the library. An attacker with low privileges and network reach can trigger it by placing a suitably malformed encrypted value where an application will decrypt it, or by otherwise controlling the responses the application receives. The impact is availability only: the affected application process stops running, with no confidentiality or integrity impact (CVSS 4.0 7.1 High, driven by a High availability impact). Any application that runs the affected library in its decryption path is exposed, though the provided data does not name specific affected version ranges. No public proof of concept, CISA KEV listing, or reported in-the-wild exploitation is known, and EPSS estimates a 0.2% probability of exploitation within 30 days (5th percentile).

What to do: Inventory applications that embed MongoDB's client-side encryption library and determine whether they decrypt values that an outside party can influence. Monitor MongoDB's security advisory for patched releases and upgrade promptly when fixed versions are announced, as none are specified in the available data. In the interim, restrict write access to stores holding encrypted values, add supervisor-based automatic process restarts, and monitor decryption paths for aborts or crashes.