MongoDB Go Driver: Denial of service via integer overflow in BSON parsing
Summary
The MongoDB Go Driver contains an integer overflow in the handling of BSON value lengths. An attacker who can supply malformed BSON bytes to an affected application can trigger a runtime panic that terminates the application process. No authentication is required, but only applications that validate or read untrusted BSON are exposed. The issue affects availability only; no confidentiality or integrity impact is documented.
Affected
- MongoDB Go Driver v1.0.0 up to (excluding) v1.2.0
- MongoDB Go Driver v2.0.0 up to (excluding) v2.9.0
Fixed in
- MongoDB Go Driver v2.9.0 (vendor fix for Go Driver v2)
- Go Driver v1: Unknown. Confirm the fixed v1 version with MongoDB before relying on any v1 release.
Workaround
- Unknown. No vendor-documented mitigation found.
- If an upgrade is not possible, do not pass untrusted BSON to validation or read paths without a recover wrapper, and limit the size and source of the BSON accepted by the endpoint.
Exploitation
- No public proof-of-concept or confirmed exploitation found at the time of research.
- CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
- Presence in the CISA KEV catalogue not verified.
Our recommendation
- Identify Go services that use the MongoDB Go Driver, for example with govulncheck or a dependency scan.
- Upgrade Go Driver v2 to v2.9.0 and determine which v1 version is in use; confirm the fixed v1 version with MongoDB.
- Prioritise internet-facing services that parse BSON from untrusted sources; internal-only use is lower priority.
- Check whether container or virtualisation products in use ship the driver and apply their vendor patches.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MongoDB JIRA GODRIVER-4102 jira.mongodb.org
- MongoDB Go Driver releases github.com
- Ubuntu security notice CVE-2026-107324 ubuntu.com
- Tenable CVE-2026-107324 www.tenable.com
- Strix CVE-2026-107324 www.strix.ai
- VulDB 415552 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:48.
Original description (NVD)
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.