← Vulnerability feed

Vulnerability record · CVE-2021-20328 · published 25 February 2021

CVE-2021-20328: Mongodb java driver improper certificate validation vulnerability

Mongodb · Java Driver

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

6.8 CVSS 3.1 Medium EPSS 0.43% · top 64.9% CWE-295 · Improper certificate validation
6.8CVSS 3.1 base score, v2 4.3
0.43%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jira.mongodb.org/browse/JAVA-4017 Issue TrackingPatchVendor Advisory
https://jira.mongodb.org/browse/JAVA-4017 Issue TrackingPatchVendor Advisory

Track CVE-2021-20328 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-6267Quarkus vulnerabilityA flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is …EPSS 0.72%9.8CVE-2022-4116Redhat build of quarkus vulnerabilityA vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to…EPSS 33%9.8CVE-2022-2466Quarkus http request smuggling vulnerabilityIt was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.EPSS 1.9%9.8CVE-2022-21724Postgresql jdbc driver vulnerabilitypgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The…EPSS 3.1%9.1CVE-2024-12225Quarkus authentication bypass via alternate path vulnerabilityA vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for regist…EPSS 0.41%9.1CVE-2023-6394Quarkus missing authorization vulnerabilityA flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operati…EPSS 0.81%9.1CVE-2021-26291Apache maven origin validation error vulnerabilityApache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting …EPSS 8.7%8.8CVE-2026-39852Quarkus incorrect authorization vulnerabilityQuarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, …EPSS 0.63%

Source: NIST National Vulnerability Database (record CVE-2021-20328), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.