---
id: CVE-2026-2303
aliases:
  - GHSA-cp6g-7hqx-qxhp
  - GO-2026-5327
title: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling
summary: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
vendor: mongo-driver
product: go.mongodb.org/mongo-driver
ecosystem: go
affected:
  - go.mongodb.org/mongo-driver < 1.17.7
  - go.mongodb.org/mongo-driver/v2 < 2.4.2
patched:
  - go.mongodb.org/mongo-driver 1.17.7
  - go.mongodb.org/mongo-driver/v2 2.4.2
published: '2026-02-10'
updated: '2026-07-24'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-cp6g-7hqx-qxhp'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-2303'
  - url: 'https://github.com/mongodb/mongo-go-driver'
  - url: 'https://jira.mongodb.org/browse/GODRIVER-3770'
tags:
  - osv
  - go
epss: 0.00232
epssPercentile: 0.12503
ingestedAt: '2026-07-25T19:08:11.325Z'
---

## Overview

The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

## Affected packages

- `go.mongodb.org/mongo-driver < 1.17.7`
- `go.mongodb.org/mongo-driver/v2 < 2.4.2`

## Remediation

Upgrade to a patched release:

- `go.mongodb.org/mongo-driver 1.17.7`
- `go.mongodb.org/mongo-driver/v2 2.4.2`