CVE-2026-107324
CVE
Medium
· CVSS 5.9
False PositiveMongoDB Go Driver: Panic via Integer Overflow in BSON Value Length Handling
This advisory does not affect KrakenD
The MongoDB Go Driver is only present in KrakenD as a transitive dependency of a
third-party library. The BSON packages that contain the vulnerable code are compiled
in, but KrakenD never processes BSON data from requests, responses or any other
source, so the code is never reached. KrakenD does not connect to MongoDB.
Component
MongoDB Go Driver (BSON)
Disclosed
Nov 4, 2026
CVSS Score
5.9
Description
An integer overflow in how the MongoDB Go Driver handles BSON value lengths can cause
a runtime panic when an application validates or accesses a malformed BSON document.
An unauthenticated attacker who can supply BSON bytes to an affected application may
crash the process, causing a denial of service. This does not affect KrakenD.