Bug 2531591 (CVE-2026-88032)

Summary: CVE-2026-88032 mongodb-java-driver: mongodb-driver-reactivestreams: mongodb-crypt: MongoDB Java Driver: Denial of Service via use-after-free in client-side encryption cancellation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ant, cescoffi, fmongiar, gmalinko, gsmet, janstey, jmartisk, jnethert, manderse, olubyans, ozzy, pdelbell, pjindal, rguimara, rstepani, sbiarozk, varjain
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the MongoDB Java Driver. A use-after-free vulnerability in the reactive client-side encryption component can occur when an encrypted operation is cancelled. An attacker able to cause such an operation to be cancelled may cause the hosting application process to terminate. This can lead to a denial of service (DoS) for applications using an affected reactive encryption configuration that retrieves Key Management Service (KMS) credentials on demand.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-10 18:31:51 UTC 
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.