CVE-2026-107324: Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver

Overview

Severity: Medium (CVSS 5.9)
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploit Status: Not Exploited
Patch Tuesday: 2026-Oct
Released: 2026-10-11
Last Updated: 2026-10-13
EPSS Score: 0.23% (percentile: 12.9%)

Affected Products (8)

Other

21915-17084
21916-17084
21904-17084
21902-17084
17793-17084
21894-17084
21929-17084
21903-17084

Revision History

2026-10-11: Information published.
2026-10-12: Information published.
2026-10-13: Information published.