CVE-2026-81523

Katalog CVE

CVSS 4.4 · Medium EPSS 0,10%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada mongodb libmongocrypt. Skor CVSS 3.1 4.4 (Medium) menurut mongodb.com.

Deskripsi (NVD)

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

17 September 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber mongodb.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

0,10% peluang dieksploitasi; lebih tinggi dari 0,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.mongodb.org/browse/MONGOCRYPT-977 advisory vendor · issue tracking · patch
• https://github.com/mongodb/libmongocrypt/releases/tag/1.20.3 product