CVE-2026-2303: MongoDB mongo-go-driver heap out-of-bounds read in GSSAPI error handling

Executive brief

The MongoDB Go driver, which allows applications to communicate with MongoDB databases, contains a flaw in how it handles Kerberos authentication on Linux and macOS. An attacker with basic network access could potentially cause the application to read memory outside of its intended area during authentication errors. This could lead to unexpected application behavior or unauthorized data modification.

Technical details

The mongo-go-driver's CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS contain a heap out-of-bounds read. The vulnerability exists in the C wrapper implementation due to an incorrect assumption that GSSAPI buffers are null-terminated or contain extra padding. Because the GSSAPI standard does not guarantee null termination, the driver may read one byte past the allocated heap buffer during error handling. This can be triggered over the network by an authenticated user. Patches are available in versions 1.17.7 and 2.4.2.

Affected products

• MongoDB mongo-go-driver < 1.17.7
• MongoDB mongo-go-driver/v2 < 2.4.2

Timeline

• 2026-02-10: disclosed
• 2026-02-10: advisory
• 2026-06-18: patched: Advisory updated with patch information

References

• https://api.github.com/users/OddBloke
• https://github.com/OddBloke
• https://api.github.com/users/OddBloke/gists%7B/gist_id%7D
• https://api.github.com/users/OddBloke/repos
• https://avatars.githubusercontent.com/u/62736?v=4
• https://api.github.com/users/OddBloke/events%7B/privacy%7D