CVE-2026-2303

Name of the Vulnerable Software and Affected Versions mongo-go-driver (affected versions not specified)

Description The software contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation has a heap out-of-bounds read issue because of incorrect assumptions about string termination in the GSSAPI standard. GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, which leads to reading one byte past the allocated heap buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.