CVE-2021-20328: Improper Certificate Validation in MongoDB
Summary
CVE-2021-20328: Improper Certificate Validation in MongoDB. Affects org.mongodb:mongodb-driver across 2 version ranges.
>= 3.11.0, < 3.11.3
>= 3.12.0, < 3.12.8
Fixed in 3.11.3 or 3.12.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MongoDB is an open-source NoSQL database management system that provides high performance, scalability, and flexibility. It is widely used in various applications and platforms. The Java driver for MongoDB enables Java applications to interact with MongoDB databases. This vulnerability affects specific versions of the Java driver that support client-side field level encryption (CSFLE).
Vulnerability Detail
The vulnerability arises from the failure of the Java driver to perform correct host name verification on the Key Management Service (KMS) server's certificate. In the presence of an active Man-in-the-Middle (MITM) attack and a privileged network position, an attacker can intercept the traffic between the Java driver and the KMS service. This interception renders the Field Level Encryption (FLE) ineffective, potentially exposing sensitive data. It is important to note that this vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments.
How To Fix
Latest published version: 3.12.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.11.0, < 3.11.33.11.3 -
>= 3.12.0, < 3.12.83.12.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to upgrade to the fixed versions of the affected packages.
Conclusion
The vulnerability in the Java driver for MongoDB can lead to the interception of traffic and render Field Level Encryption ineffective. It is crucial to upgrade to the fixed versions of the affected packages to ensure the security of the application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.mongodb:mongodb-driver →
FAQ
This vulnerability can lead to the interception of traffic between the Java driver and the KMS service, rendering Field Level Encryption ineffective. It could potentially expose sensitive data to attackers.
All versions of the Java driver that support client-side field level encryption (CSFLE) are affected. The Java async, Scala, and reactive streams drivers are not impacted.
No, applications residing inside the AWS, GCP, and Azure network fabrics are not affected by this vulnerability due to compensating controls in these environments.
No, driver workloads that don't use Field Level Encryption are not impacted by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
