CVE-2026-107324 Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver

High 8.2 Published 8 Oct 2026 Updated 8 Oct 2026

An attacker can cause a denial of service by sending malformed BSON data that triggers an integer overflow and runtime panic in the MongoDB Go Driver.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-107324?

CVE-2026-107324 is a high-severity vulnerability in MongoDB Go Driver, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.

Weakness: CWE-190

Which versions are affected by CVE-2026-107324?

It affects 1 product.

Products include Mongodb Go Driver.

How do I fix CVE-2026-107324?

No fix has been published for CVE-2026-107324 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-107324 being exploited?

There is no known exploitation of CVE-2026-107324 in the wild and no public exploit code.

Sources

Also known as AZL-107060, AZL-107084, AZL-107123, AZL-107558, AZL-107586, AZL-107604 and 8 more.