libmongocrypt-helper 1.20.1.0.1001 → 1.20.5.0.1001

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5f3bd46869436cf55ec31236a73965ec1f198f75809d53e084aebb6c056bead0
-  data.tar.gz: 4868779b572f103a7f7f6ae88ea15032dd829e31c5a85e1f41364bd0d7f17d60
+  metadata.gz: b483fc7b479e693858209265fa305b4bd51e34592b452bbbd36c32c13f262802
+  data.tar.gz: 352d1052b07f14081865b5c02fe8b33ce2b0a739550db43a6e57d6c26cd1a08b
 SHA512:
-  metadata.gz: 57f84ed485336784bd0dd5008a4d2f893146f3cb4128c121d5e91dc5bb8c80c07f8d7a6e44edd869327876c1b0410b1790b84a0548bb0459b6e7bc53a7151a83
-  data.tar.gz: 27917b4a2c97d98db62661d48f0c3dace264f84f83ba9fd1f9de351dc11a20bb0f29445c51ffa94b82b51716adb1bf925bf18804358d5bac1b701651bc735846
+  metadata.gz: 945910ccf2515b64cbd9dd1d97a9de2822562a2544533006e3aa5fa7837107697f6b38e5f43d0da1ce3218fa98d36362a9f883362d9e1efb16bb90fbee7d5236
+  data.tar.gz: ef89918bdf09d579c60cce8aa5ecdd779a655edffc7223fef5a97fc00fa63ef787c3d5b360ce880812dc3d96562c1ebda7ca158ba4968377e1fd95fcb9c9a81c

data/ext/libmongocrypt/libmongocrypt/CHANGELOG.md

@@ -1,5 +1,26 @@
 # ChangeLog
 
+## 1.20.5
+
+### Fixed
+- Fix possible abort parsing endpoints.
+- Reject more payloads that cannot be decrypted in explicit decryption.
+- Fix more degenerate cases of masterKey parsing.
+
+## 1.20.4
+
+### Fixed
+- Reject undersized decryption payloads.
+
+## 1.20.3
+
+### Fixed
+- Validate database and collection name arguments against "." and NUL bytes
+## 1.20.2
+
+### Changed
+- Add checks when creating GCP requests.
+
 ## 1.20.1
 
 ## Changed

data/ext/libmongocrypt/libmongocrypt/Earthfile

@@ -438,12 +438,12 @@ test-deb-packages-from-ppa:
     RUN ./test.out
 
 # `sign` uses Garasign to sign a file with the libmongocrypt key.
-# Requires prior authentication with Artifactory.
+# Requires prior authentication with the DevProd Platforms ECR registry (see doc/releasing.md).
 # See: https://docs.devprod.prod.corp.mongodb.com/release-tools-container-images/garasign/garasign_signing/.
 sign:
     ARG --required file_to_sign
     ARG --required output_file
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-local/garasign-gpg
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/garasign-gpg
     WORKDIR /s
     COPY ${file_to_sign} /s/file
     RUN --secret garasign_username --secret garasign_password \
@@ -460,8 +460,9 @@ sign:
 #   An environment with the `silkbomb` command.
 #
 # See https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/ for documentation of silkbomb.
+# Requires prior authentication with the DevProd Platforms ECR registry (see doc/releasing.md).
 silkbomb:
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0
     # Alias the silkbomb executable to a simpler name:
     RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb
 

data/ext/libmongocrypt/libmongocrypt/bindings/python/CONTRIBUTING.md

@@ -28,6 +28,18 @@ bash scripts/update-version.sh <new-version>
 This will set the version in `scripts/libmongocrypt-version.sh` and update `sbom.json` to reflect
 the new vendored version of `libmongocrypt`.
 
+This pulls the `silkbomb` image from the DevProd Platforms ECR registry. Authenticate to the ECR
+registry with the container launcher (`docker` or `podman`) before running the script:
+
+```bash
+aws sso login --profile ECRScopedAccess-901841024863
+
+# Authenticate "podman" or "docker"
+CONTAINER_LAUNCHER="podman"
+
+aws ecr get-login-password --region us-east-1 --profile ECRScopedAccess-901841024863 | $CONTAINER_LAUNCHER login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+```
+
 ## Building wheels
 
 To build wheels, run `scripts/release.sh`.  It will build the appropriate wheel for the current system

data/ext/libmongocrypt/libmongocrypt/bindings/python/scripts/update-version.sh

@@ -21,7 +21,7 @@ else
 fi
 
 echo "pkg:github/mongodb/libmongocrypt@$LIBMONGOCRYPT_VERSION" > purls.txt
-$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json
+$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json
 rm purls.txt
 
 popd

data/ext/libmongocrypt/libmongocrypt/doc/releasing.md

@@ -93,6 +93,15 @@ Do the following when releasing:
    ```bash
    ./.evergreen/earthly.sh +sbom-generate-new-serial-number
    ```
+   This pulls the `silkbomb` image from the DevProd Platforms ECR registry. Authenticate to the ECR registry with the container launcher (`docker` or `podman`):
+   ```bash
+   aws sso login --profile ECRScopedAccess-901841024863
+
+   # Authenticate "podman" or "docker"
+   CONTAINER_LAUNCHER="podman"
+
+   aws ecr get-login-password --region us-east-1 --profile ECRScopedAccess-901841024863 | $CONTAINER_LAUNCHER login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+   ```
    Commit resulting `etc/cyclonedx.sbom.json` and push to `rx.y`.
 - Remove yourself from the [releases team](https://github.com/orgs/mongodb/teams/dbx-c-cxx-releases) on GitHub via [MANA](https://mana.corp.mongodb.com/resources/68029673d39aa9f7de6399f9).
 - If this is a new non-patch release (e.g. `x.y.0`):
@@ -130,6 +139,7 @@ Do the following when releasing:
      ```bash
      ./.evergreen/earthly.sh +sbom-generate-new-serial-number
      ```
+     Requires AWS SSO access to the `ECRScopedAccess-901841024863` profile (see note above).
      Commit resulting `etc/cyclonedx.sbom.json`.
 - Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions).
 - Record the release on [C/C++ Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing). This is done to leave commentary about the process.

data/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json

@@ -57,7 +57,7 @@
     }
   ],
   "metadata": {
-    "timestamp": "2026-07-14T13:56:19.068748+00:00",
+    "timestamp": "2026-09-03T12:34:15.836217+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -100,7 +100,7 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:870a42e2-38df-4271-afee-8ffa5c28bcf7",
+  "serialNumber": "urn:uuid:f38989f9-86cb-4a6e-94b5-bbcbf0a8fc1f",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_gcp_request.c

@@ -20,6 +20,8 @@
 #include "kms_message_private.h"
 #include "kms_request_opt_private.h"
 
+#include <ctype.h>
+
 /* Set a default expiration of 5 minutes for JSON Web Tokens (GCP allows up to
  * one hour) */
 #define JWT_EXPIRATION_SECS 5 * 60
@@ -145,6 +147,38 @@ done:
    return req;
 }
 
+/* _check_key_identifier returns true if `value` is safe to use as a URL path segment.
+ *
+ * Key identifiers may originate from key vault documents or caller-supplied options. They are
+ * formatted into the request path, so an unescaped '/', '?', '#', space, or CR/LF would rewrite
+ * the request target or inject header lines into the request.
+ *
+ * Only the RFC 3986 unreserved characters are permitted. This is a superset of what GCP itself
+ * accepts, so it does not reject any identifier that would otherwise work:
+ * - keyRing and keyName must match `[a-zA-Z0-9_-]{1,63}`. See
+ *   https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings/create and
+ *   https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys/create
+ * - projectId is 6-30 characters of lowercase letters, numbers, and hyphens. See
+ *   https://cloud.google.com/resource-manager/docs/creating-managing-projects
+ * - location is a Cloud location name (e.g. "global", "us-east1").
+ * - keyVersion is a positive integer.
+ *
+ * `value` is not included in the error message: it is untrusted, and the error may be logged. */
+static bool
+_check_key_identifier (kms_request_t *req, const char *name, const char *value)
+{
+   const char *c;
+
+   for (c = value; *c != '\0'; c++) {
+      if (!isalnum ((unsigned char) *c) && *c != '-' && *c != '.' && *c != '_' &&
+          *c != '~') {
+         KMS_ERROR (req, "Invalid character in GCP KMS key identifier: %s", name);
+         return false;
+      }
+   }
+   return true;
+}
+
 static kms_request_t *
 _encrypt_decrypt_common (const char *encrypt_decrypt,
                          const char *host,
@@ -192,6 +226,14 @@ _encrypt_decrypt_common (const char *encrypt_decrypt,
       goto done;
    }
 
+   if (!_check_key_identifier (req, "projectId", project_id) ||
+       !_check_key_identifier (req, "location", location) ||
+       !_check_key_identifier (req, "keyRing", key_ring_name) ||
+       !_check_key_identifier (req, "keyName", key_name) ||
+       (key_version && !_check_key_identifier (req, "keyVersion", key_version))) {
+      goto done;
+   }
+
    value_base64 = kms_message_raw_to_b64 (value, value_len);
    if (!value_base64) {
       KMS_ERROR (req, "Could not bases64-encode plaintext");

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-insert-update-payload-v2.c

@@ -523,7 +523,12 @@ const _mongocrypt_buffer_t *mc_FLE2InsertUpdatePayloadV2_decrypt(_mongocrypt_cry
         return NULL;
     }
 
-    _mongocrypt_buffer_resize(&iup->plaintext, fle2v2->get_plaintext_len(ciphertext.len, status));
+    const uint32_t plaintext_len = fle2v2->get_plaintext_len(ciphertext.len, status);
+    if (!mongocrypt_status_ok(status)) {
+        return NULL;
+    }
+
+    _mongocrypt_buffer_resize(&iup->plaintext, plaintext_len);
     uint32_t bytes_written;
 
     if (!fle2v2->do_decrypt(crypto, &iup->userKeyId, user_key, &ciphertext, &iup->plaintext, &bytes_written, status)) {

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-insert-update-payload.c

@@ -252,7 +252,12 @@ const _mongocrypt_buffer_t *mc_FLE2InsertUpdatePayload_decrypt(_mongocrypt_crypt
         return NULL;
     }
 
-    _mongocrypt_buffer_resize(&iup->plaintext, fle2aead->get_plaintext_len(ciphertext.len, status));
+    const uint32_t plaintext_len = fle2aead->get_plaintext_len(ciphertext.len, status);
+    if (!mongocrypt_status_ok(status)) {
+        return NULL;
+    }
+
+    _mongocrypt_buffer_resize(&iup->plaintext, plaintext_len);
     uint32_t bytes_written; /* ignored */
 
     if (!fle2aead

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-payload-iev.c

@@ -353,7 +353,11 @@ static bool mc_FLE2IndexedEncryptedValue_decrypt(_mongocrypt_crypto_t *crypto,
     const _mongocrypt_buffer_t *token_buf = mc_ServerDataEncryptionLevel1Token_get(token);
     uint32_t bytes_written;
 
-    _mongocrypt_buffer_resize(&iev->Inner, fle2alg->get_plaintext_len(iev->InnerEncrypted.len, status));
+    const uint32_t inner_len = fle2alg->get_plaintext_len(iev->InnerEncrypted.len, status);
+    if (!mongocrypt_status_ok(status)) {
+        return false;
+    }
+    _mongocrypt_buffer_resize(&iev->Inner, inner_len);
 
     /* Decrypt InnerEncrypted. */
     if (!fle2alg->do_decrypt(crypto,
@@ -445,7 +449,11 @@ bool mc_FLE2IndexedEncryptedValue_add_K_Key(_mongocrypt_crypto_t *crypto,
         return false;
     }
     /* Attempt to decrypt ClientEncryptedValue */
-    _mongocrypt_buffer_resize(&iev->ClientValue, fle2aead->get_plaintext_len(iev->ClientEncryptedValue.len, status));
+    const uint32_t client_value_len = fle2aead->get_plaintext_len(iev->ClientEncryptedValue.len, status);
+    if (!mongocrypt_status_ok(status)) {
+        return false;
+    }
+    _mongocrypt_buffer_resize(&iev->ClientValue, client_value_len);
     uint32_t bytes_written;
     if (!fle2aead->do_decrypt(crypto,
                               &iev->K_KeyId,

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-payload-uev-common.c

@@ -93,7 +93,7 @@ const _mongocrypt_buffer_t *_mc_FLE2UnindexedEncryptedValueCommon_decrypt(_mongo
     memcpy(AD.data + 1, key_uuid->data, key_uuid->len);
     AD.data[1 + key_uuid->len] = (uint8_t)original_bson_type;
     const uint32_t plaintext_len = fle2aead->get_plaintext_len(ciphertext->len, status);
-    if (plaintext_len == 0) {
+    if (!mongocrypt_status_ok(status)) {
         _mongocrypt_buffer_cleanup(&AD);
         return NULL;
     }

data/ext/libmongocrypt/libmongocrypt/src/mc-schema-broker.c

@@ -323,7 +323,11 @@ bool mc_schema_broker_satisfy_from_collinfo(mc_schema_broker_t *sb,
             CLIENT_ERR("failed to find 'name' in collinfo in database: %s", sb->db);
             return false;
         }
-        coll = bson_iter_utf8(&name_iter, NULL);
+        uint32_t coll_len;
+        coll = bson_iter_utf8(&name_iter, &coll_len);
+        if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "collection name in collinfo", status)) {
+            return false;
+        }
     }
 
     // Cache the received collinfo.
@@ -508,7 +512,11 @@ bool mc_schema_broker_satisfy_from_create_or_collMod(mc_schema_broker_t *sb,
         CLIENT_ERR("Failed to get collection name from command");
         return false;
     }
-    const char *coll = bson_iter_utf8(&iter, NULL);
+    uint32_t coll_len;
+    const char *coll = bson_iter_utf8(&iter, &coll_len);
+    if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "collection name", status)) {
+        return false;
+    }
 
     // Check if schema was requested.
     mc_schema_entry_t *found = NULL;

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-crypto.c

@@ -443,9 +443,9 @@ static uint32_t _mongocrypt_calculate_plaintext_len(uint32_t inlen,
                                                     _mongocrypt_hmac_type_t hmac,
                                                     mongocrypt_status_t *status) {
     const uint32_t hmaclen = (hmac == HMAC_NONE) ? 0 : MONGOCRYPT_HMAC_LEN;
-    const uint32_t mincipher = (mode == MODE_CTR) ? 0 : MONGOCRYPT_BLOCK_SIZE;
+    const uint32_t mincipher = (mode == MODE_CTR) ? 1 : MONGOCRYPT_BLOCK_SIZE;
     if (inlen < (MONGOCRYPT_IV_LEN + mincipher + hmaclen)) {
-        CLIENT_ERR("input ciphertext too small. Must be at least %" PRIu32 " bytes",
+        CLIENT_ERR("input ciphertext too small. Must be more than %" PRIu32 " bytes",
                    MONGOCRYPT_IV_LEN + mincipher + hmaclen);
         return 0;
     }
@@ -1346,7 +1346,11 @@ bool _mongocrypt_unwrap_key(_mongocrypt_crypto_t *crypto,
 
     // _mongocrypt_wrap_key() uses FLE1 algorithm parameters.
     _mongocrypt_buffer_init(dek);
-    _mongocrypt_buffer_resize(dek, fle1alg->get_plaintext_len(encrypted_dek->len, status));
+    const uint32_t plaintext_len = fle1alg->get_plaintext_len(encrypted_dek->len, status);
+    if (!mongocrypt_status_ok(status)) {
+        return false;
+    }
+    _mongocrypt_buffer_resize(dek, plaintext_len);
 
     if (!fle1alg->do_decrypt(crypto, NULL /* associated data. */, kek, encrypted_dek, dek, &bytes_written, status)) {
         return false;

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-decrypt.c

@@ -344,7 +344,7 @@ static bool _replace_FLE1Payload_with_plaintext(void *ctx,
 
     const _mongocrypt_value_encryption_algorithm_t *fle1alg = _mcFLE1Algorithm();
     plaintext.len = fle1alg->get_plaintext_len(ciphertext.data.len, status);
-    CHECK_AND_RETURN(plaintext.len != 0);
+    CHECK_AND_RETURN(mongocrypt_status_ok(status));
     plaintext.data = bson_malloc0(plaintext.len);
     BSON_ASSERT(plaintext.data);
 
@@ -766,6 +766,25 @@ static void _cleanup(mongocrypt_ctx_t *ctx) {
     _mongocrypt_buffer_cleanup(&dctx->decrypted_doc);
 }
 
+/* Returns true if a subtype-6 payload's first byte names a recognized FLE blob
+ * subtype. */
+static bool _is_decryptable_fle_blob_subtype(uint8_t byte) {
+    switch (byte) {
+    case MC_SUBTYPE_FLE1DeterministicEncryptedValue:
+    case MC_SUBTYPE_FLE1RandomEncryptedValue:
+    case MC_SUBTYPE_FLE2InsertUpdatePayload:
+    case MC_SUBTYPE_FLE2UnindexedEncryptedValue:
+    case MC_SUBTYPE_FLE2IndexedEqualityEncryptedValue:
+    case MC_SUBTYPE_FLE2IndexedRangeEncryptedValue:
+    case MC_SUBTYPE_FLE2InsertUpdatePayloadV2:
+    case MC_SUBTYPE_FLE2IndexedEqualityEncryptedValueV2:
+    case MC_SUBTYPE_FLE2IndexedRangeEncryptedValueV2:
+    case MC_SUBTYPE_FLE2UnindexedEncryptedValueV2:
+    case MC_SUBTYPE_FLE2IndexedTextEncryptedValue: return true;
+    default: return false;
+    }
+}
+
 bool mongocrypt_ctx_explicit_decrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *msg) {
     bson_iter_t iter;
     bson_t as_bson;
@@ -804,6 +823,14 @@ bool mongocrypt_ctx_explicit_decrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_bina
             CLIENT_ERR("decryption expected BSON binary subtype %d, got %d", (int)BSON_SUBTYPE_ENCRYPTED, (int)subtype);
             return _mongocrypt_ctx_fail(ctx);
         }
+        if (binary_len == 0) {
+            CLIENT_ERR("unsupported FLE blob subtype: expected non-empty payload");
+            return _mongocrypt_ctx_fail(ctx);
+        }
+        if (!_is_decryptable_fle_blob_subtype(binary[0])) {
+            CLIENT_ERR("unsupported FLE blob subtype: %hhu", binary[0]);
+            return _mongocrypt_ctx_fail(ctx);
+        }
     }
 
     if (!mongocrypt_ctx_decrypt_init(ctx, msg)) {

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-encrypt.c

@@ -2303,7 +2303,11 @@ static bool _check_cmd_for_auto_encrypt_bulkWrite(mongocrypt_binary_t *cmd,
         return false;
     }
 
-    const char *target_ns = bson_iter_utf8(&ns_iter, NULL /* length */);
+    uint32_t target_ns_len;
+    const char *target_ns = bson_iter_utf8(&ns_iter, &target_ns_len);
+    if (!_mongocrypt_check_no_embedded_nul(target_ns, target_ns_len, "namespace in `bulkWrite` command", status)) {
+        return false;
+    }
     // Parse `target_ns` into "<db>.<coll>"
     const char *dot = strstr(target_ns, ".");
     if (!dot) {
@@ -2375,7 +2379,12 @@ _check_cmd_for_auto_encrypt(mongocrypt_binary_t *cmd, bool *bypass, char **targe
     }
 
     if (BSON_ITER_HOLDS_UTF8(&target_coll_iter)) {
-        *target_coll = bson_strdup(bson_iter_utf8(&target_coll_iter, NULL));
+        uint32_t target_coll_len;
+        const char *target_coll_str = bson_iter_utf8(&target_coll_iter, &target_coll_len);
+        if (!_mongocrypt_check_no_embedded_nul(target_coll_str, target_coll_len, "collection name", status)) {
+            return false;
+        }
+        *target_coll = bson_strdup(target_coll_str);
     } else {
         *target_coll = NULL;
     }
@@ -2572,7 +2581,11 @@ static bool find_collections_in_pipeline(mc_schema_broker_t *sb,
                                    stage_key);
                         return false;
                     }
-                    const char *from = bson_iter_utf8(&lookup_iter, NULL);
+                    uint32_t from_len;
+                    const char *from = bson_iter_utf8(&lookup_iter, &from_len);
+                    if (!_mongocrypt_check_no_embedded_nul(from, from_len, "'from' collection name", status)) {
+                        return false;
+                    }
                     if (!mc_schema_broker_request(sb, db, from, status)) {
                         return false;
                     }
@@ -2631,7 +2644,11 @@ static bool find_collections_in_pipeline(mc_schema_broker_t *sb,
                                    stage_key);
                         return false;
                     }
-                    const char *coll = bson_iter_utf8(&unionWith_iter, NULL);
+                    uint32_t coll_len;
+                    const char *coll = bson_iter_utf8(&unionWith_iter, &coll_len);
+                    if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "'coll' collection name", status)) {
+                        return false;
+                    }
                     if (!mc_schema_broker_request(sb, db, coll, status)) {
                         return false;
                     }
@@ -2722,6 +2739,10 @@ bool mongocrypt_ctx_encrypt_init(mongocrypt_ctx_t *ctx, const char *db, int32_t
         return _mongocrypt_ctx_fail_w_msg(ctx, "invalid db");
     }
 
+    if (strchr(ectx->cmd_db, '.')) {
+        return _mongocrypt_ctx_fail_w_msg(ctx, "invalid db: must not contain a dot");
+    }
+
     if (0 == strcmp(ectx->cmd_name, "bulkWrite")) {
         // Handle `bulkWrite` as a special case.
         // `bulkWrite` includes the target namespaces in an `nsInfo` field.

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-endpoint.c

@@ -34,6 +34,104 @@ void _mongocrypt_endpoint_destroy(_mongocrypt_endpoint_t *endpoint) {
     bson_free(endpoint);
 }
 
+/* RFC 3986 section 2.3: unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~" */
+static bool _is_unreserved(char c) {
+    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '-' || c == '.'
+        || c == '_' || c == '~';
+}
+
+/* RFC 3986 section 2.2: reserved = gen-delims / sub-delims */
+static bool _is_reserved(char c) {
+    return NULL
+        != strchr(":/?#[]@" /* gen-delims */
+                  "!$&'()*+,;=" /* sub-delims */,
+                  c);
+}
+
+static bool _is_hexdig(char c) {
+    return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F');
+}
+
+/* _endpoint_chars_are_valid returns true if `endpoint_raw` contains only characters permitted in a URI
+ * by RFC 3986. Useful to prevent malformed endpoints being used to construct HTTP requests. */
+static bool _endpoint_chars_are_valid(const char *endpoint_raw, mongocrypt_status_t *status) {
+    for (const char *c = endpoint_raw; *c != '\0'; c++) {
+        if (_is_unreserved(*c) || _is_reserved(*c)) {
+            continue;
+        }
+        if (*c == '%') {
+            /* Returns false if either character is the NUL terminator. */
+            if (!_is_hexdig(c[1])) {
+                CLIENT_ERR("Invalid percent-encoding in endpoint at offset %zu: 0x%02x",
+                           (size_t)(c - endpoint_raw) + 1,
+                           (unsigned char)c[1]);
+                return false;
+            }
+            if (!_is_hexdig(c[2])) {
+                CLIENT_ERR("Invalid percent-encoding in endpoint at offset %zu: 0x%02x",
+                           (size_t)(c - endpoint_raw) + 2,
+                           (unsigned char)c[2]);
+                return false;
+            }
+            c += 2;
+            continue;
+        }
+        CLIENT_ERR("Invalid character in endpoint at offset %zu: 0x%02x",
+                   (size_t)(c - endpoint_raw),
+                   (unsigned char)*c);
+        return false;
+    }
+    return true;
+}
+
+/* RFC 3986 section 2.2: sub-delims. Permitted in a reg-name; gen-delims are not. */
+static bool _is_sub_delim(char c) {
+    return NULL != strchr("!$&'()*+,;=", c);
+}
+
+/* _host_chars_are_valid returns true if `host` is an RFC 3986 section 3.2.2 `reg-name`:
+ *
+ *   reg-name = *( unreserved / pct-encoded / sub-delims )
+ *
+ * The gen-delims (":/?#[]@") are not permitted. The parse above already ends the host at ':', '/', and '?',
+ * so in practice this rejects '#', '@', and the brackets of an IP-literal.
+ *
+ * This is defense in depth. `host` reaches the Host header, where CR and LF are the only characters that can
+ * alter the message and kms-message rejects them, and `host_and_port` is passed to the consumer as the
+ * address to connect to, where a gen-delim yields a name that does not resolve rather than a structural
+ * problem. An `IP-literal` (RFC 3986 section 3.2.2) is not supported: the parse splits the host at the first
+ * colon with no bracket handling, so "[2001:db8::1]" yielded a host of "[2001" and a port of "db8::1]". */
+static bool _host_chars_are_valid(const char *host, mongocrypt_status_t *status) {
+    for (const char *c = host; *c != '\0'; c++) {
+        if (_is_unreserved(*c) || _is_sub_delim(*c)) {
+            continue;
+        }
+        if (*c == '%') {
+            /* Already validated by _endpoint_chars_are_valid. */
+            c += 2;
+            continue;
+        }
+        CLIENT_ERR("Invalid character in endpoint host: 0x%02x", (unsigned char)*c);
+        return false;
+    }
+    return true;
+}
+
+/* _port_chars_are_valid returns true if `port` is a non-empty run of digits. */
+static bool _port_chars_are_valid(const char *port, mongocrypt_status_t *status) {
+    if (*port == '\0') {
+        CLIENT_ERR("Invalid endpoint, expected a port after the colon");
+        return false;
+    }
+    for (const char *c = port; *c != '\0'; c++) {
+        if (*c < '0' || *c > '9') {
+            CLIENT_ERR("Invalid character in endpoint port: 0x%02x", (unsigned char)*c);
+            return false;
+        }
+    }
+    return true;
+}
+
 /* Parses a subset of URIs of the form:
  * [protocol://][host[:port]][path][?query]
  */
@@ -61,6 +159,11 @@ _mongocrypt_endpoint_t *_mongocrypt_endpoint_new(const char *endpoint_raw,
         goto fail;
     }
 
+    /* Validate before parsing: every field parsed below is a substring of `original`. */
+    if (!_endpoint_chars_are_valid(endpoint->original, status)) {
+        goto fail;
+    }
+
     /* Parse optional protocol. */
     pos = strstr(endpoint->original, "://");
     if (pos) {
@@ -92,14 +195,15 @@ _mongocrypt_endpoint_t *_mongocrypt_endpoint_new(const char *endpoint_raw,
     colon = strstr(pos, ":");
     qmark = strstr(pos, "?");
     slash = strstr(pos, "/");
-    if (colon) {
-        host_end = colon;
-    } else if (slash) {
+    /* The host ends at the first delimiter. A colon delimits a port only if it
+     * precedes the path and query: in "example.com/path:8080" the colon is part
+     * of the path, not a port separator. */
+    host_end = colon;
+    if (slash && (!host_end || slash < host_end)) {
         host_end = slash;
-    } else if (qmark) {
+    }
+    if (qmark && (!host_end || qmark < host_end)) {
         host_end = qmark;
-    } else {
-        host_end = NULL;
     }
 
     if (host_end) {
@@ -112,12 +216,16 @@ _mongocrypt_endpoint_t *_mongocrypt_endpoint_new(const char *endpoint_raw,
         endpoint->host = bson_strdup(host_start);
     }
 
+    if (!_host_chars_are_valid(endpoint->host, status)) {
+        goto fail;
+    }
+
     /* Parse optional port */
-    if (colon) {
+    if (colon && colon == host_end) {
         prev = colon + 1;
-        qmark = strstr(pos, "?");
-        slash = strstr(pos, "/");
-        if (slash) {
+        qmark = strstr(prev, "?");
+        slash = strstr(prev, "/");
+        if (slash && (!qmark || slash < qmark)) {
             endpoint->port = bson_strndup(prev, (size_t)(slash - prev));
         } else if (qmark) {
             BSON_ASSERT(qmark >= prev);
@@ -125,6 +233,10 @@ _mongocrypt_endpoint_t *_mongocrypt_endpoint_new(const char *endpoint_raw,
         } else {
             endpoint->port = bson_strdup(prev);
         }
+
+        if (!_port_chars_are_valid(endpoint->port, status)) {
+            goto fail;
+        }
     }
 
     /* Parse optional path */