CVE-2026-2303
MediumSummary
The mongo-go-driver contains a heap out-of-bounds read vulnerability in the CGo implementation for GSSAPI (Kerberos) authentication on Linux and macOS. The issue arises from incorrect assumptions about string termination in the GSSAPI standard, potentially leading to data disclosure.
Risk Assessment
An attacker could exploit this vulnerability to read sensitive data from process memory, potentially exposing passwords, keys, or other confidential authentication information.
Recommendation
Immediately update the mongo-go-driver library to a patched version that fixes the vulnerability. Until updated, restrict access to MongoDB services using Kerberos authentication.
Original NVD description (English source)
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guara