CVE-2026-2303Medium· 6.5▾ Sunlitmongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
0.2% → 0.2%
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
go.mongodb.org/mongo-driver < 1.17.7go.mongodb.org/mongo-driver/v2 < 2.4.2Upgrade to a patched release:
go.mongodb.org/mongo-driver 1.17.7go.mongodb.org/mongo-driver/v2 2.4.2