GitHub Advisoryadvisory · Go

GHSA-cp6g-7hqx-qxhp mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

MEDIUM Published 2026-02-10 Modified 2026-06-18 Official page ↗
Aliases
CVE-2026-2303
Ecosystem
Go
Packages
go.mongodb.org/mongo-driver, go.mongodb.org/mongo-driver/v2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-183
Reviewed
2026-06-18

Affected packages

• Go go.mongodb.org/mongo-driver: < 1.17.7 → fixed in 1.17.7 • Go go.mongodb.org/mongo-driver/v2: < 2.4.2 → fixed in 2.4.2

Description

The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

Related

Alias · CVE (1)

  • CVE-2026-2303 The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. vulnerability

Weakness · CWE (1)

  • CWE-183 Permissive List of Allowed Inputs weakness

References