Log in Start free

Vulnerability · Published Oct 8, 2026 · Assigned by mongodb

CVE-2026-107325Application denial of service via missing BSON array length validation in MongoDB Go Driver

Medium 5.9

In plain English

A medium-severity security flaw in Go Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.2%top 85.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-mongodb-mongo-driverno fix listedDEBIAN-CVE-2026-107325
Debian:13golang-mongodb-mongo-driverno fix listedDEBIAN-CVE-2026-107325
Debian:14golang-mongodb-mongo-driverno fix listedDEBIAN-CVE-2026-107325
Ubuntu:24.04:LTSgolang-mongodb-mongo-driverno fix listedUBUNTU-CVE-2026-107325
Ubuntu:26.04:LTSgolang-mongodb-mongo-driverno fix listedUBUNTU-CVE-2026-107325
Ubuntu:26.10golang-mongodb-mongo-driverno fix listedUBUNTU-CVE-2026-107325

Affected products (as reported)

VendorProductVersions
MongoDB Go Driver 1.1.0 – before 1.*2.0.0 – before 2.9.2

Weakness: CWE-129 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References