The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
| Link | Providers |
|---|---|
| https://jira.mongodb.org/browse/GODRIVER-3770 |
|
History
Tue, 10 Feb 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer. | |
| Title | Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak | |
| Weaknesses | CWE-183 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: mongodb
Published:
Updated: 2026-02-10T19:03:06.737Z
Reserved: 2026-02-10T18:55:27.871Z
Link: CVE-2026-2303
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-02-10T20:17:00.757
Modified: 2026-02-10T21:51:48.077
Link: CVE-2026-2303
Redhat
No data.
OpenCVE Enrichment
No data.