{"id":"CVE-2026-2303","aliases":["GHSA-cp6g-7hqx-qxhp","GO-2026-5327"],"title":"mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling","summary":"mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","vendor":"mongo-driver","product":"go.mongodb.org/mongo-driver","ecosystem":"go","affected":["go.mongodb.org/mongo-driver < 1.17.7","go.mongodb.org/mongo-driver/v2 < 2.4.2"],"patched":["go.mongodb.org/mongo-driver 1.17.7","go.mongodb.org/mongo-driver/v2 2.4.2"],"published":"2026-02-10","updated":"2026-07-24","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-cp6g-7hqx-qxhp","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2303"},{"url":"https://github.com/mongodb/mongo-go-driver"},{"url":"https://jira.mongodb.org/browse/GODRIVER-3770"}],"tags":["osv","go"],"epss":0.00232,"epssPercentile":0.14325,"ingestedAt":"2026-07-25T19:08:11.325Z","slug":"CVE-2026-2303","body":"## Overview\n\nThe mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.\n\n## Affected packages\n\n- `go.mongodb.org/mongo-driver < 1.17.7`\n- `go.mongodb.org/mongo-driver/v2 < 2.4.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `go.mongodb.org/mongo-driver 1.17.7`\n- `go.mongodb.org/mongo-driver/v2 2.4.2`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}