_EncryptionIO.kms_request passes the KMS endpoint surfaced by libmongocrypt straight to parse_host(endpoint, 443). parse_host returns any string ending in .sock verbatim, skipping the hostname/port validation applied to every other input. _create_connection (and the async equivalent in pymongo/pool_shared.py) then treats an address ending in .sock as a Unix domain socket path and connects to it with AF_UNIX.

libmongocrypt builds that endpoint from masterKey.endpoint in key vault documents, which _EncryptionIO.fetch_keys reads back from the server on every KMS request (key cache ~60s). A party able to write a key vault document can therefore redirect the driver's KMS connection to an arbitrary local socket path on the application host. The documented custom KMS endpoint feature only supports TCP hosts, so this crosses a boundary it should not.

Impact is capped at connect side effects: the Unix socket is still wrapped in verifying TLS using the .sock string as server_hostname, so the handshake fails and no KMS payload is ever sent. The attacker controls the connect target but not the transmitted bytes.

Proposed fix: reject .sock-suffixed KMS endpoints immediately after parse_host, before any connection is attempted, on both the sync and async paths.

See SECBUG-4279 for the full analysis.