Integer Overflow Vulnerability in MongoDB Go Driver Affects Applications

CVE-2026-107324

What is CVE-2026-107324?

An integer overflow in BSON value-length handling within the MongoDB Go Driver can lead to unexpected application behavior. This issue arises when an application attempts to validate or access a malformed BSON document, potentially resulting in a runtime panic. Unauthenticated actors can exploit this vulnerability by supplying malicious BSON bytes to the affected application, leading to a denial of service. Although the driver's server-monitoring path includes panic recovery, it is limited to server-selection failures, which does not mitigate the risk of application termination.

References