Is CVE-2026-2303 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2303 being exploited in the wild.

How severe is CVE-2026-2303?

Medium severity, with a CVSS score of 6.5, published 10 February 2026.

Which products and versions are affected?

go.mongodb.org/mongo-driver (Go) < 1.17.7, SEMVER:introduced=0,fixed=1.17.7; go.mongodb.org/mongo-driver/v2 (Go) < 2.4.2, SEMVER:introduced=0,fixed=2.4.2; MongoDB Go Driver < 1.17.7; MongoDB Go Driver v2 < 2.4.2.

Is there a fix for CVE-2026-2303?

Yes. go.mongodb.org/mongo-driver (Go): upgrade to 1.17.7 or later; go.mongodb.org/mongo-driver/v2 (Go): upgrade to 2.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2303 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-2303?

Check whether you run go.mongodb.org/mongo-driver (Go), go.mongodb.org/mongo-driver/v2 (Go), MongoDB Go Driver or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2303: MongoDB mongo-go-driver heap out-of-bounds read in GSSAPI error handling

Q: Is there a fix for CVE-2026-2303?

Yes. go.mongodb.org/mongo-driver (Go): upgrade to 1.17.7 or later; go.mongodb.org/mongo-driver/v2 (Go): upgrade to 2.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-2303 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-2303?

Check whether you run go.mongodb.org/mongo-driver (Go), go.mongodb.org/mongo-driver/v2 (Go), MongoDB Go Driver or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2303 · Severity: medium · CVSS 6.5 · Published 2026-02-10

The MongoDB Go driver, which allows applications to communicate with MongoDB databases, contains a flaw in how it handles Kerberos authentication on Linux and macOS. An attacker with basic network access could potentially cause the application to read memory outside of its intended area during authentication errors. This could lead to unexpected application behavior or unauthorized data modification.

Technologies: go.mongodb.org/mongo-driver (Go), MongoDB Go Driver. Vendors: Go, MongoDB.

Quick answers

Is CVE-2026-2303 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2303 being exploited in the wild.
How severe is CVE-2026-2303?: Medium severity, with a CVSS score of 6.5, published 10 February 2026.
Which products and versions are affected?: go.mongodb.org/mongo-driver (Go) < 1.17.7, SEMVER:introduced=0,fixed=1.17.7; go.mongodb.org/mongo-driver/v2 (Go) < 2.4.2, SEMVER:introduced=0,fixed=2.4.2; MongoDB Go Driver < 1.17.7; MongoDB Go Driver v2 < 2.4.2.
Is there a fix for CVE-2026-2303?: Yes. go.mongodb.org/mongo-driver (Go): upgrade to 1.17.7 or later; go.mongodb.org/mongo-driver/v2 (Go): upgrade to 2.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2303 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-2303?: Check whether you run go.mongodb.org/mongo-driver (Go), go.mongodb.org/mongo-driver/v2 (Go), MongoDB Go Driver or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.mongodb.org/mongo-driver (Go): upgrade to 1.17.7 or later
```
go get go.mongodb.org/mongo-driver@v1.17.7
```
go.mongodb.org/mongo-driver/v2 (Go): upgrade to 2.4.2 or later
```
go get go.mongodb.org/mongo-driver/v2@v2.4.2
```

Technical details

The mongo-go-driver's CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS contain a heap out-of-bounds read. The vulnerability exists in the C wrapper implementation due to an incorrect assumption that GSSAPI buffers are null-terminated or contain extra padding. Because the GSSAPI standard does not guarantee null termination, the driver may read one byte past the allocated heap buffer during error handling. This can be triggered over the network by an authenticated user. Patches are available in versions 1.17.7 and 2.4.2.

Affected products

MongoDB mongo-go-driver < 1.17.7
MongoDB mongo-go-driver/v2 < 2.4.2

Identifiers

CVE-2026-2303
GHSA-cp6g-7hqx-qxhp
GO-2026-5327

Timeline

2026-02-10: disclosed
2026-02-10: advisory
2026-06-18: patched: Advisory updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.