Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-107324

Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Go Driver

Default version status: unaffected

  • 1.0.0 to < 1.2.0affected
  • 2.0.0 to < 2.9.0affected

References