{"id":"CVE-2026-107325","title":"Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array","summary":"Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthe…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-129"],"vendor":"MongoDB","product":"Go Driver","affected":["go_driver >= 1.1.0 < 1.*","go_driver >= 2.0.0 < 2.9.2"],"published":"2026-10-08","updated":"2026-10-15","sourceUpdated":"2026-10-15T17:17:12.513","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107325","references":[{"url":"https://jira.mongodb.org/browse/GODRIVER-4136","label":"cna@mongodb.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-08T19:32:24.880891Z"},"epss":0.00236,"epssPercentile":0.14573,"ingestedAt":"2026-10-08T20:06:22.185Z","slug":"CVE-2026-107325","body":"## Overview\n\nImproper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}