Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-2303

Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Inc MongoDB Go Driver

Default version status: unaffected

  • 1.0.0 to < 1.17.7affected
  • 2.0.0 to < 2.4.2affected

References