PatchTheCVElibmongocrypt vulnerabilities and fixes
Recent CVEs affecting libmongocrypt, with upgrade or downgrade steps. 3 tracked.
libmongocrypt has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-09-03. Highest priority: CVE-2026-84971 (score 27/100).
- CVE-2026-84962 MEDIUM 4.2 UPGRADE An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticat
- CVE-2026-81523 MEDIUM 4.4 UPGRADE A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller
- CVE-2026-84971 MEDIUM 6.5 UPGRADE Improper handling of an unexpected value size in the decryption path of a client-side encryption library can c
FAQ
How do I fix libmongocrypt vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libmongocrypt being exploited right now?
None of the tracked libmongocrypt CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libmongocrypt CVE should I patch first?
CVE-2026-84971 currently ranks highest (27/100): Improper handling of an unexpected value size in the decryption path of a client-side encryption library can c.