CVE-2026-2303 Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak
An attacker can trigger a heap out-of-bounds read in the MongoDB Go Driver's GSSAPI bindings, causing application crashes or leaking sensitive memory information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-2303?
CVE-2026-2303 is a medium-severity memory corruption vulnerability in MongoDB Go Driver, published on 10 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
Weakness: CWE-183
Which versions are affected by CVE-2026-2303?
6 open source packages ship an affected version, including go.mongodb.org/mongo-driver and go.mongodb.org/mongo-driver/v2.
| Package | Affected | Fixed in |
|---|---|---|
go.mongodb.org/mongo-driver Go | All versions | 1.17.7 |
go.mongodb.org/mongo-driver Go | All versions | 1.17.7 |
go.mongodb.org/mongo-driver Go | All versions | 1.17.7 |
go.mongodb.org/mongo-driver/v2 Go | All versions | 2.4.2 |
go.mongodb.org/mongo-driver/v2 Go | All versions | 2.4.2 |
go.mongodb.org/mongo-driver/v2 Go | All versions | 2.4.2 |
Linux distribution packages (7)
apptainer SUSE:Linux Enterprise Module for HPC 15 SP7 | All versions | 1.5.1-150600.4.29.1 |
squashfuse SUSE:Linux Enterprise Module for HPC 15 SP7 | All versions | 0.5.0-150600.3.4.1 |
apptainer SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 1.5.1-150600.4.29.1 |
squashfuse SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 0.5.0-150600.3.4.1 |
apptainer openSUSE:Leap 16.0 | All versions | 1.5.1-bp160.2.1 |
apptainer openSUSE:Tumbleweed | All versions | 1.5.1-3.1 |
golang-github-prometheus-alertmanager openSUSE:Tumbleweed | All versions | 0.34.1-2.1 |
How do I fix CVE-2026-2303?
Upgrade go.mongodb.org/mongo-driver to 1.17.7 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-2303 being exploited?
There is no known exploitation of CVE-2026-2303 in the wild and no public exploit code.
Sources
Also known as AZL-77525, AZL-77547, AZL-77559, CLEANSTART-2026-CA40991, CLEANSTART-2026-EI57937, CLEANSTART-2026-EU28747 and 237 more.