Source: golang-mongodb-mongo-driver Version: 1.17.9+ds1-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for golang-mongodb-mongo-driver. CVE-2026-107324[0]: | An integer overflow in BSON value-length handling in the MongoDB Go | Driver can cause a runtime panic when an application validates or | accesses a malformed BSON document. An unauthenticated actor who can | supply BSON bytes to an affected application may terminate an | unprotected application process, causing a denial of service. The | driver's server-monitoring path contains panic recovery and is | limited to server-selection failure. CVE-2026-107325[1]: | Improper validation of a BSON array length in the MongoDB Go Driver | can cause an out-of-bounds index and runtime panic when an | application calls bson.RawArray.Validate or bsoncore.Array.Validate | on a malformed four-byte array. An unauthenticated actor who can | supply raw BSON array data to an affected application may terminate | an unprotected application process, causing a denial of service. No | confidentiality or integrity impact has been identified. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-107324 https://www.cve.org/CVERecord?id=CVE-2026-107324 [1] https://security-tracker.debian.org/tracker/CVE-2026-107325 https://www.cve.org/CVERecord?id=CVE-2026-107325 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
