Affected: Homebrew: mongo-orchestration

### Summary

PyMongo passed the KMS endpoint of a data key verbatim into `parse_host()`, which returns any string ending in `.sock` unchanged instead of validating it as a hostname and port. The driver's connection code then treats such an address as a Unix domain socket path and connects to it with `AF_UNIX`. Because the endpoint originates from `masterKey.endpoint` in a key vault document, a party who can write to the key vault could redirect the driver's KMS connection to an arbitrary Unix domain socket path on the application host.

### Impact

An application using client-side field level encryption (CSFLE) or Queryable Encryption is affected if an attacker can write to its key vault collection. Setting `masterKey.endpoint` on a data key to a `.sock`-suffixed string causes the next KMS request for that key (key cache TTL is ~60 seconds) to open an `AF_UNIX` connection to the attacker-chosen filesystem path from inside the victim application process. The documented custom KMS endpoint feature supports TCP hosts only, so this crosses a boundary the feature was never intended to allow.

Impact is limited to the side effects of the connection itself. The socket is still wrapped in a verifying TLS context using the `.sock` string as `server_hostname`, and insecure KMS TLS options are rejected, so the handshake always fails and the KMS message is never sent. The attacker controls the connect target but not the transmitted bytes (a fixed TLS ClientHello).

Applications that do…

Affected: MongoDB Python Driver

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.