Limit the number of metadata blocks that can appear in a FLE2IndexedTextEncryptedValue

XMLWordPrintableJSON

    • Server Security
    • ALL
    • v9.0, v8.3, v8.2
    • Server Security 2026-06-05, Server Security 2026-08-14
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      The server enforces a tag limit of 84k tags per field during a FLE2 insert of a substring/prefix/suffix indexed payload when it serializes a FLE2IndexedTextEncryptedValue from the Insert/Update payload in FLE2IndexedTextEncryptedValue::fromUnencrypted(). This same assertion is not enforced in the constructor FLE2IndexedTextEncryptedValue(ConstDataRange toParse) where we parse some buffer into a FLE2IndexedTextEncryptedValue. If the buffer contains a large value in the "edge_count" field, it may trigger an overflow or a large allocation in the libmongocrypt parsing function mc_FLE2IndexedEncryptedValueV2_parse that may cause a crash.

            Assignee:
            Erwin Pe
            Reporter:
            Erwin Pe
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: