CVE-2026-107325: CWE-129: Improper Validation of Array Index in MongoDB Go Driver

The MongoDB Go Driver improperly validates the length of BSON arrays in the bson.RawArray.Validate and bsoncore.Array.Validate functions. When these functions process a malformed four-byte array, an out-of-bounds index access can occur, triggering a runtime panic. This vulnerability allows an unauthenticated actor who can supply raw BSON array data to cause an unprotected application to crash, leading to denial of service. No confidentiality or integrity impacts have been reported. The vulnerability affects versions >=1.1.0 <=1.17.10 and >=2.0.0 <2.9.2 of the MongoDB Go Driver.

An unauthenticated attacker can cause a denial of service by supplying malformed BSON array data that triggers an out-of-bounds index and runtime panic in the MongoDB Go Driver. This results in application process termination. There is no impact on data confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should consider validating or sanitizing BSON input before processing to mitigate potential denial of service. No official fix or patch links have been provided at this time.