Skip to content
Heist/ feed
Unrated

DEBIAN-CVE-2026-88032

Type: advisorySource: OSV1 source record

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-88032

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-88032

mongo-java-driver

Source reference: /affected/0/package/name

Affected versions
3.6.3-2

Source reference: /affected/0/versions

3.6.3-2.1

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mongo-java-driver

Source reference: /affected/1/package/name

Affected versions
3.6.3-2

Source reference: /affected/1/versions

3.6.3-2.1

Source reference: /affected/1/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mongo-java-driver

Source reference: /affected/2/package/name

Affected versions
3.6.3-2

Source reference: /affected/2/versions

3.6.3-2.1

Source reference: /affected/2/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mongo-java-driver",
      "purl": "pkg:deb/debian/mongo-java-driver?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "3.6.3-2",
      "3.6.3-2.1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88032.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mongo-java-driver",
      "purl": "pkg:deb/debian/mongo-java-driver?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "3.6.3-2",
      "3.6.3-2.1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88032.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mongo-java-driver",
      "purl": "pkg:deb/debian/mongo-java-driver?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "3.6.3-2",
      "3.6.3-2.1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88032.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#58535 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement