Unrated

DEBIAN-CVE-2026-88032

Type: advisorySource: OSV1 source record

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

Announced 10 Sept 2026Group revision 1

Original source ↗

DEBIAN-CVE-2026-88032

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-88032

mongo-java-driver

Source reference: /affected/0/package/name

Affected versions: 3.6.3-2
Source reference: /affected/0/versions
3.6.3-2.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

mongo-java-driver

Source reference: /affected/1/package/name

Affected versions: 3.6.3-2
Source reference: /affected/1/versions
3.6.3-2.1
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

mongo-java-driver

Source reference: /affected/2/package/name

Affected versions: 3.6.3-2
Source reference: /affected/2/versions
3.6.3-2.1
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mongo-java-driver",
      "purl": "pkg:deb/debian/mongo-java-driver?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "3.6.3-2",
      "3.6.3-2.1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88032.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mongo-java-driver",
      "purl": "pkg:deb/debian/mongo-java-driver?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "3.6.3-2",
      "3.6.3-2.1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88032.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mongo-java-driver",
      "purl": "pkg:deb/debian/mongo-java-driver?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "3.6.3-2",
      "3.6.3-2.1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88032.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #58535 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 18:11:34 GMT
Publisher date: Thu, 10 Sep 2026 19:17:40 GMT

Read the original announcement

Revision history

25 Oct 2026DEBIAN-CVE-2026-88032 · Revision 1Source updated