CVE-2026-107325

Name of the Vulnerable Software and Affected Versions MongoDB Go Driver (affected versions not specified)

Description Improper validation of a BSON array length can lead to an out-of-bounds index and runtime panic. This occurs when an application invokes the bson.RawArray.Validate or bsoncore.Array.Validate functions on a malformed four-byte array. An unauthenticated actor capable of providing raw BSON array data to the application can trigger a process termination, resulting in a denial of service. BSON (Binary JSON) is a binary-encoded serialization of JSON-like documents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.