CVE-2026-107324
MediumCVSS 5.9Summary
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service.
Risk Assessment
An attacker can cause the application process to terminate, leading to denial of service.
Recommendation
Upgrade the MongoDB Go Driver to a patched version if available, or apply mitigations such as input validation.
Other vulnerabilities in MongoDB Go Driver
See all- CVE-2026-107325Medium
Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service.
- CVE-2026-88031High
The GridFS component of the MongoDB Go Driver contains an improper neutralization of special elements in data query logic, where a caller-supplied structured file identifier can be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may cause all GridFS file chunks in the affected bucket to be removed.
- CVE-2026-81521Medium
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace. An application passing untrusted input as a database name could have the write directed at a database and collection other than intended.
Original NVD description (English source)
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS