Every CVE Search/ Get API key

CVE-2026-107325

Application denial of service via missing BSON array length validation in MongoDB Go Driver

8.2 HighFix available

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.24%Unchanged since Oct 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.2

Application denial of service via missing BSON array length validation in MongoDB Go Driver

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
CVE-2026-107325
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
EUVDEUVD-2026-95170 8.2

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
EUVD-2026-95170
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-frr6-8pf7-f9r2 8.2

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds...

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
GHSA-frr6-8pf7-f9r2
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
NVD 8.2

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
CVE-2026-107325
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
OSV 8.2

Application denial of service via missing BSON array length validation in MongoDB Go Driver

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
CVE-2026-107325
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-129
Updated
2026-11-02
OSVDEBIAN-CVE-2026-107325 8.2

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
DEBIAN-CVE-2026-107325
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 13 moreShow less
OSVUBUNTU-CVE-2026-107325 8.2

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
UBUNTU-CVE-2026-107325
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-107057 No score

CVE-2026-107325 affecting package cri-o 1.30.1-1

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-107057
Updated
2026-11-05
OSVAZL-107090 No score

CVE-2026-107325 affecting package kata-containers-preview 3.27.0~preview2-2

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-107090
Updated
2026-11-05
OSVAZL-107108 No score

CVE-2026-107325 affecting package podman 5.6.1-10

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-107108
Updated
2026-11-05
OSVAZL-107547 No score

CVE-2026-107325 affecting package kata-containers for versions less than 4.1.0.kata1-2

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-107547
Updated
2026-11-05
OSVAZL-107579 No score

CVE-2026-107325 affecting package kata-containers-cc for versions less than 3.15.0.aks0-23

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-107579
Updated
2026-11-05
OSVAZL-107595 No score

CVE-2026-107325 affecting package keda 2.14.1-19

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-107595
Updated
2026-11-02
OSVAZL-107655 No score

CVE-2026-107325 affecting package kubevirt for versions less than 1.8.4-4

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-107655
Updated
2026-11-05
OSVAZL-107697 No score

CVE-2026-107325 affecting package libcontainers-common 20240213-3

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-107697
Updated
2026-11-02
OSVAZL-107802 No score

CVE-2026-107325 affecting package packer for versions less than 1.9.5-23

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-107802
Updated
2026-11-05
OSVAZL-107865 No score

CVE-2026-107325 affecting package skopeo for versions less than 1.14.4-15

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-107865
Updated
2026-11-05
OSVAZL-107907 No score

CVE-2026-107325 affecting package telegraf for versions less than 1.31.0-35

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-107907
Updated
2026-11-05
OSVAZL-111560 No score

CVE-2026-107325 affecting package kubevirt-openvmm 1.9.0-1

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

Record
AZL-111560
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cri-o
Azure Linux:3
through 1.30.1-1 None known
kata-containers-preview
Azure Linux:3
through 3.27.0~preview2-2 None known
podman
Azure Linux:3
through 5.6.1-10 None known
kata-containers
Azure Linux:3
before 4.1.0.kata1-2
4.1.0.kata1-2
kata-containers-cc
Azure Linux:3
before 3.15.0.aks0-23
3.15.0.aks0-23
keda
Azure Linux:3
through 2.14.1-19 None known
kubevirt
Azure Linux:3
before 1.8.4-4
1.8.4-4
libcontainers-common
Azure Linux:3
through 20240213-3 None known
packer
Azure Linux:3
before 1.9.5-23
1.9.5-23
skopeo
Azure Linux:3
before 1.14.4-15
1.14.4-15
Show 8 moreShow less
Affected packages
PackageAffectedFixed
telegraf
Azure Linux:3
before 1.31.0-35
1.31.0-35
kubevirt-openvmm
Azure Linux:3
through 1.9.0-1 None known
golang-mongodb-mongo-driver
Debian:12
All versions, plus listed versions
1.12.1+ds1-11.12.1+ds1-21.16.1+ds1-11.17.0+ds1-11.17.1+ds1-1
Show 4 moreShow less
1.17.1+ds1-21.17.1+ds1-31.17.9+ds1-11.8.4+ds1-3
None known
golang-mongodb-mongo-driver
Debian:13
All versions, plus listed versions
1.17.1+ds1-21.17.1+ds1-31.17.9+ds1-1
None known
golang-mongodb-mongo-driver
Debian:14
All versions, plus listed versions
1.17.1+ds1-21.17.1+ds1-31.17.9+ds1-1
None known
golang-mongodb-mongo-driver
Ubuntu:24.04:LTS
All versions, plus listed versions
1.8.4+ds1-1ubuntu11.12.1+ds1-2
None known
golang-mongodb-mongo-driver
Ubuntu:26.10
All versions, plus listed versions
1.17.1+ds1-21.17.9+ds1-1
None known
golang-mongodb-mongo-driver
Ubuntu:26.04:LTS
All versions, plus listed versions
1.17.1+ds1-2
None known

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-107325 is a high vulnerability (CVSS 8.2) in Mongodb Go Driver, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. Fixed in kata-containers 4.1.0.kata1-2.

References

MoveEnter Open