-
Type:
Bug
-
Resolution: Unresolved
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: Queryable Encryption
-
None
-
Server Security
-
ALL
-
v9.0, v8.3, v8.2
-
Server Security 2026-06-05, Server Security 2026-08-14
-
None
-
None
-
None
-
None
-
None
-
None
-
None
The server enforces a tag limit of 84k tags per field during a FLE2 insert of a substring/prefix/suffix indexed payload when it serializes a FLE2IndexedTextEncryptedValue from the Insert/Update payload in FLE2IndexedTextEncryptedValue::fromUnencrypted(). This same assertion is not enforced in the constructor FLE2IndexedTextEncryptedValue(ConstDataRange toParse) where we parse some buffer into a FLE2IndexedTextEncryptedValue. If the buffer contains a large value in the "edge_count" field, it may trigger an overflow or a large allocation in the libmongocrypt parsing function mc_FLE2IndexedEncryptedValueV2_parse that may cause a crash.