CVE-2026-107325
CVE
Medium
· CVSS 5.9
False PositiveMongoDB Go Driver: Out-of-Bounds Panic via Malformed BSON Array Length
This advisory does not affect KrakenD
The MongoDB Go Driver is only present in KrakenD as a transitive dependency of a
third-party library. The BSON packages that contain the vulnerable code are compiled
in, but KrakenD never processes BSON data from requests, responses or any other
source, so the code is never reached. KrakenD does not connect to MongoDB.
Component
MongoDB Go Driver (BSON)
Disclosed
Nov 4, 2026
CVSS Score
5.9
Description
The MongoDB Go Driver does not properly validate the length of a BSON array. Calling
bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array
causes an out-of-bounds index and a runtime panic. An unauthenticated attacker who can
supply raw BSON array data to an affected application may crash the process, causing
a denial of service. This does not affect KrakenD.