CVE-2026-107324: CWE-190: Integer Overflow or Wraparound in MongoDB Go Driver

This vulnerability involves an integer overflow or wraparound in the BSON value-length handling within the MongoDB Go Driver. When an application validates or accesses a malformed BSON document, the overflow can trigger a runtime panic. An unauthenticated actor who can supply BSON bytes to the affected application can cause the application process to terminate unexpectedly, leading to denial of service. The server-monitoring path has panic recovery mechanisms that limit the impact to server-selection failures. The affected versions are >=1.0.0 and <1.2.0, and >=2.0.0 and <2.9.0.

An unauthenticated attacker can cause a denial of service by supplying malformed BSON bytes that trigger a runtime panic due to integer overflow in BSON value-length handling. This results in application process termination. The impact is limited to denial of service; no information disclosure or code execution is indicated. The server-monitoring path is protected by panic recovery, reducing risk in that area.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should consider validating BSON inputs carefully and implementing protective measures such as input sanitization or running the driver in environments where process restarts are managed. Monitor MongoDB's official advisories for updates and patches addressing this vulnerability.