CVE-2026-2303
MediumAdvisory
Published 10 Feb 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.002
- 14th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 579
- of 17,787 indexed, latest versions
- Container images
- 607
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling
Carried by container images the latest versions of 579 of 17,787 indexed charts deploy, on 607 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.mongodb.org/ | v1.0.0, v1.0.3, v1.0.4, v1.1.0+54 more | 1.17.7 | 604 |
| go.mongodb.org/ | v2.2.2, v2.3.0, v2.3.1, v2.4.0 | 2.4.2 | 12 |
- OSV records
- GHSA-cp6g-7hqx-qxhp
- Also known as
- GO-2026-5327
Charts affected
579 by stars
Container images carrying it
607 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 58f4f180aa6e | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 7db1a1bf3dae | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 46a71d75dfd3 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 0af2faec9d6f | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 74426c1fe00f | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 50b431281d3e | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | c8882543f693 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | d22616a5998b | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 02348a19aeae | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 112fc427d933 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 72dc058e478d | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 167fd532bd43 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 73a2ebae4413 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | f312f50ddc57 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | b40439329191 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | ebd03028ff6a | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | df6b11907d33 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | ec36422b09af | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 42574f512837 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 4e2a3cce7ce8 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 9518de37eed5 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | e93dfe7454d4 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | e24894e32cbc | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 6bf945565865 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 560a16a56d4e | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 06ed5db6cd33 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | b914032ef9ad | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 9c73f1841ebc | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | a61c7022abcf | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 832a32779e6d | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 185d2eebc60c | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 63f7eaf5aa8a | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | c62e3347611c | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 5c109914ff73 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 5dfa86b6451f | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | b69bcdaa8492 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 84f70425f4dd | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 45e744fc623f | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | f65f6810ea23 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | ef92da4621e6 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | df917c5a7e54 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 7fbc6855c8b3 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 056f0953763d | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 9c7bc0f9bb35 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | ff23f452813a | go.mongodb.org/ | 2.4.2 | 1 |
| ghcr.io/ | ebbd44abae6c | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 2fe6b69b20d7 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | edc238a538a0 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 3ebe2fd253f6 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | b61c750ade19 | go.mongodb.org/ | 1.17.7 | 1 |