CVE-2026-107325: Application denial of service via missing BSON array length validation in MongoDB Go Driver
Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service condition?
Applications using the MongoDB Go Driver are exposed if they call bson.RawArray.Validate or bsoncore.Array.Validate on attacker-controlled raw BSON array data. The affected input is a malformed four-byte BSON array.
Does an attacker need authentication or user interaction to trigger the issue?
No. An unauthenticated actor can trigger the condition if they can supply raw BSON array data to the affected application; no user interaction is required.
What is the operational impact of successful exploitation?
The malformed array can cause an out-of-bounds index and runtime panic, terminating an unprotected application process. The reported impact is availability only; no confidentiality or integrity impact has been identified.