CVE-2026-2303

EUVD-2026-7065
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mongodbCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
mongodbgo_driver
1.0.0 ≤
𝑥
< 1.17.7
CNA
mongodbgo_driver
2.0.0 ≤
𝑥
< 2.4.2
CNA
Azure Linux logo
Azure Linux Releases
Azure Package
Release
keda
Azure Linux 3.0
0:2.14.1-11.azl3
fixed
telegraf
Azure Linux 3.0
0:1.31.0-15.azl3
fixed
CBL-Mariner 2.0
0:1.29.4-21.cm2
fixed
Common Weakness Enumeration
References
https://jira.mongodb.org/browse/GODRIVER-3770