Vulnerability · Published Feb 10, 2026 · Assigned by mongodb
CVE-2026-2303Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak
Medium 6.5
In plain English
A medium-severity security flaw in MongoDB Go Driver from MongoDB Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | go.mongodb.org/mongo-driver | 1.17.7 | GHSA-cp6g-7hqx-qxhp |
| Go | go.mongodb.org/mongo-driver | 1.17.7 | GO-2026-5327 |
| Go | go.mongodb.org/mongo-driver/v2 | 2.4.2 | GHSA-cp6g-7hqx-qxhp |
| Go | go.mongodb.org/mongo-driver/v2 | 2.4.2 | GO-2026-5327 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc | MongoDB Go Driver | 1.0.0 – before 1.17.72.0.0 – before 2.4.2 |
Weakness: CWE-183 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N