CVE-2026-107325: MongoDB Go Driver BSON DoS Vulnerability

CVE-2026-107325 Overview

CVE-2026-107325 is a denial-of-service vulnerability in the MongoDB Go Driver. Improper validation of a BSON array length causes an out-of-bounds index access and runtime panic. The flaw triggers when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated attacker who can supply raw BSON array data to an affected application can terminate the process. The vulnerability is categorized under CWE-129: Improper Validation of Array Index. No confidentiality or integrity impact has been identified.

Critical Impact
An unauthenticated remote attacker can crash any Go application that validates attacker-supplied BSON array data, causing service outage.

Affected Products

MongoDB Go Driver (go.mongodb.org/mongo-driver)
Applications invoking bson.RawArray.Validate
Applications invoking bsoncore.Array.Validate

Discovery Timeline

2026-10-08 - CVE-2026-107325 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-107325

Vulnerability Analysis

The vulnerability resides in the BSON array validation routines of the MongoDB Go Driver. BSON (Binary JSON) encodes arrays with a four-byte little-endian length prefix followed by element data. The validator reads this prefix but does not confirm the declared length matches the actual byte slice length before indexing into it.

When bson.RawArray.Validate or bsoncore.Array.Validate processes a crafted four-byte array, the function calculates an element offset that exceeds the slice bounds. Go's runtime detects the out-of-bounds access and raises a panic. Unless the calling goroutine wraps the call with recover, the panic propagates and terminates the process.

The attack requires only that malformed BSON reach the validation path. Any application accepting externally supplied BSON documents — including API gateways, data ingestion services, or driver middleware — is exposed.

Root Cause

The root cause is missing bounds validation between the declared BSON array length and the actual buffer size. The validator trusts the attacker-controlled length prefix and performs arithmetic that produces an index outside the allocated slice.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a malformed four-byte BSON array to any endpoint that forwards the payload into the vulnerable validation function. Successful exploitation panics the Go runtime, dropping the application and all in-flight requests. See the MongoDB Jira Issue GODRIVER-4136 for upstream tracking.

Detection Methods for CVE-2026-107325

Indicators of Compromise

Repeated Go runtime panic messages referencing bsoncore or bson.RawArray.Validate in application logs
Unexpected process restarts or crash loops on services accepting BSON input
Network traffic containing BSON payloads with length prefixes that exceed the actual payload size

Detection Strategies

Instrument Go applications with structured logging around BSON validation calls to capture panic stack traces
Deploy input filters that compare declared BSON array lengths against received byte counts before forwarding data to the driver
Correlate application crash events with inbound request payloads to identify malformed BSON patterns

Monitoring Recommendations

Monitor process uptime and restart counts on services that parse BSON from untrusted sources
Alert on log entries containing runtime error: index out of range originating from MongoDB driver call sites
Track request rates to endpoints accepting raw BSON to detect fuzzing or probing activity

How to Mitigate CVE-2026-107325

Immediate Actions Required

Inventory all Go services that import go.mongodb.org/mongo-driver and identify those exposing BSON parsing to untrusted input
Upgrade the MongoDB Go Driver to the fixed release once published by MongoDB
Add recover handlers around validation call sites as a short-term containment measure until patches are applied

Patch Information

Refer to MongoDB Jira Issue GODRIVER-4136 for the authoritative patch and fixed-version information. Rebuild and redeploy all Go binaries that depend on the driver after upgrading.

Workarounds

Validate BSON payload size at the network or application boundary before passing data to the driver
Reject requests whose declared BSON array length does not match the actual payload length
Isolate BSON parsing in a dedicated goroutine protected by defer recover() to prevent process termination

bash

# Update the MongoDB Go Driver dependency to the fixed release
go get go.mongodb.org/mongo-driver@latest
go mod tidy
go build ./...