CyberRota Analysis
AI-GeneratedThe MongoDB Java Driver is vulnerable due to a use-after-free issue in its reactive client-side encryption component, which can lead to the premature release of native resources during an active encrypted operation if the operation is cancelled. This vulnerability may result in the termination of the hosting application process, posing a risk to applications that utilize reactive encryption configurations for on-demand KMS credential retrieval. Organizations using the affected MongoDB Java Driver should prioritize addressing this vulnerability to mitigate potential application crashes.
Original NVD Description
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.