Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-107325

Application denial of service via missing BSON array length validation in MongoDB Go Driver

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Go Driver

Default version status: unaffected

  • 1.1.0 to < 1.*affected
  • 2.0.0 to < 2.9.2affected

References