CVE-2026-107324
Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
CVE-2026-107324- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-95165
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
EUVD-2026-95165- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hrj7-rwg8-vqvg
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime...
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
GHSA-hrj7-rwg8-vqvg- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
CVE-2026-107324- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
CVE-2026-107324- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-107324
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
DEBIAN-CVE-2026-107324- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 13 moreShow less
OSVUBUNTU-CVE-2026-107324
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
UBUNTU-CVE-2026-107324- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-107060 No score
CVE-2026-107324 affecting package cri-o 1.30.1-1
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-107060- Updated
- 2026-11-05
OSVAZL-107084 No score
CVE-2026-107324 affecting package kata-containers-preview 3.27.0~preview2-2
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-107084- Updated
- 2026-11-05
OSVAZL-107123 No score
CVE-2026-107324 affecting package podman 5.6.1-10
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-107123- Updated
- 2026-11-05
OSVAZL-107558 No score
CVE-2026-107324 affecting package kata-containers for versions less than 4.1.0.kata1-2
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-107558- Updated
- 2026-11-05
OSVAZL-107586 No score
CVE-2026-107324 affecting package kata-containers-cc for versions less than 3.15.0.aks0-23
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-107586- Updated
- 2026-11-05
OSVAZL-107604 No score
CVE-2026-107324 affecting package keda 2.14.1-19
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-107604- Updated
- 2026-11-02
OSVAZL-107661 No score
CVE-2026-107324 affecting package kubevirt for versions less than 1.8.4-4
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-107661- Updated
- 2026-11-05
OSVAZL-107700 No score
CVE-2026-107324 affecting package libcontainers-common 20240213-3
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-107700- Updated
- 2026-11-02
OSVAZL-107793 No score
CVE-2026-107324 affecting package packer for versions less than 1.9.5-23
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-107793- Updated
- 2026-11-05
OSVAZL-107886 No score
CVE-2026-107324 affecting package skopeo for versions less than 1.14.4-15
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-107886- Updated
- 2026-11-05
OSVAZL-107922 No score
CVE-2026-107324 affecting package telegraf for versions less than 1.31.0-35
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-107922- Updated
- 2026-11-05
OSVAZL-111644 No score
CVE-2026-107324 affecting package kubevirt-openvmm 1.9.0-1
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
- Record
AZL-111644- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cri-oAzure Linux:3 |
through 1.30.1-1 | None known |
kata-containers-previewAzure Linux:3 |
through 3.27.0~preview2-2 | None known |
podmanAzure Linux:3 |
through 5.6.1-10 | None known |
kata-containersAzure Linux:3 |
before 4.1.0.kata1-2 | 4.1.0.kata1-2 |
kata-containers-ccAzure Linux:3 |
before 3.15.0.aks0-23 | 3.15.0.aks0-23 |
kedaAzure Linux:3 |
through 2.14.1-19 | None known |
kubevirtAzure Linux:3 |
before 1.8.4-4 | 1.8.4-4 |
libcontainers-commonAzure Linux:3 |
through 20240213-3 | None known |
packerAzure Linux:3 |
before 1.9.5-23 | 1.9.5-23 |
skopeoAzure Linux:3 |
before 1.14.4-15 | 1.14.4-15 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
telegrafAzure Linux:3 |
before 1.31.0-35 | 1.31.0-35 |
kubevirt-openvmmAzure Linux:3 |
through 1.9.0-1 | None known |
golang-mongodb-mongo-driverDebian:12 |
All versions, plus listed versions 1.12.1+ds1-11.12.1+ds1-21.16.1+ds1-11.17.0+ds1-11.17.1+ds1-1 Show 4 moreShow less1.17.1+ds1-21.17.1+ds1-31.17.9+ds1-11.8.4+ds1-3 |
None known |
golang-mongodb-mongo-driverDebian:13 |
All versions, plus listed versions 1.17.1+ds1-21.17.1+ds1-31.17.9+ds1-1 |
None known |
golang-mongodb-mongo-driverDebian:14 |
All versions, plus listed versions 1.17.1+ds1-21.17.1+ds1-31.17.9+ds1-1 |
None known |
golang-mongodb-mongo-driverUbuntu:24.04:LTS |
All versions, plus listed versions 1.8.4+ds1-1ubuntu11.12.1+ds1-2 |
None known |
golang-mongodb-mongo-driverUbuntu:26.10 |
All versions, plus listed versions 1.17.1+ds1-21.17.9+ds1-1 |
None known |
golang-mongodb-mongo-driverUbuntu:26.04:LTS |
All versions, plus listed versions 1.17.1+ds1-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107324 is a high vulnerability (CVSS 8.2) in Mongodb Go Driver, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in kata-containers 4.1.0.kata1-2.
References
jira.mongodb.org/browse/GODRIVER-4102
nvd.nist.gov/vuln/detail/CVE-2026-107324
github.com/advisories/GHSA-hrj7-rwg8-vqvg
security-tracker.debian.org/tracker/CVE-2026-107324
ubuntu.com/security/CVE-2026-107324
cve.org/CVERecord?id=CVE-2026-107324