CVE-2026-2303: Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak
MongoDB Inc · MongoDB Go Driver
Vendor fix available · Affected: MongoDB Inc MongoDB Go Driver · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 24% of scored CVEs
DescriptionCVE.org
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- MongoDB Inc · MongoDB Go Driverfrom 1.0.0 before 1.17.7; from 2.0.0 before 2.4.2
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- MongoDB Inc
- Published
- February 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-2303 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.