Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-107324 Details

Description

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:5.9 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://jira.mongodb.org/browse/GODRIVER-4102 [email protected]Vendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-190Integer Overflow or Wraparound[email protected]

Affected Products

ProductVersions
mongodb go driver
>= 1.0.0, < 1.2.0
>= 2.0.0, < 2.9.0

CPE

  • cpe:2.3:a:mongodb:go_driver:*:*:*:*:*:mongodb:*:*

Remediation

  • No remediation found in references.

Change History

3 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-107324
NVD Published Date:
Oct 8, 2026
NVD Last Modified:
Oct 27, 2026
Source:
[email protected]
CVE-2026-107324 Details - Not Deferred