CVE-2026-107324
Medium
Description
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Mongodb Go Driver
PublishedOct 8, 2026
First seenOct 8, 2026
Weakness typeCWE-190Integer overflow
How to fix
Update
- mongodb go_driver1.2.0, 2.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb go_driver | 1.0.0 ≤ v < 1.2.0, 2.0.0 ≤ v < 2.9.0 | 1.2.0, 2.9.0 |
| microsoft azl3_kata-containers_4.1.0.kata0-1 | No range specified | — |
| microsoft azl3_kata-containers-cc_3.15.0.aks0-21 | No range specified | — |
| microsoft azl3_keda_2.14.1-19 | No range specified | — |
| microsoft azl3_kubevirt_1.8.4-2 | No range specified | — |
| microsoft azl3_packer_1.9.5-21 | No range specified | — |
| microsoft azl3_skopeo_1.14.4-13 | No range specified | — |
| microsoft azl3_telegraf_1.31.0-33 | No range specified | — |
| microsoft azl3_kata-containers_4.1.0.kata1-2 | No range specified | — |
| microsoft azl3_kata-containers-cc_3.15.0.aks0-23 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.