CVE-2026-2303
MediumAdvisory
Published 10 Feb 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.002
- 14th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 581
- of 17,781 indexed, latest versions
- Container images
- 608
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling
Carried by container images the latest versions of 581 of 17,781 indexed charts deploy, on 608 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.mongodb.org/ | v1.0.0, v1.0.3, v1.0.4, v1.1.0+54 more | 1.17.7 | 605 |
| go.mongodb.org/ | v2.2.2, v2.3.0, v2.3.1, v2.4.0 | 2.4.2 | 12 |
- OSV records
- GHSA-cp6g-7hqx-qxhp
- Also known as
- GO-2026-5327
Charts affected
581 by stars
Container images carrying it
608 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| bitnamilegacy/ | 5bb0aa825d16 | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | 6dabb4a2088c | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | 8935e75fa5d1 | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | 952f86d1116c | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | ba9f3b4b0b00 | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | c0ede65eb88e | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | cce234b4381a | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | d7cd0e172c4c | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | 21e8f8baa432 | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | 2579e968033e | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | 3163c3842bfd | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | 3bb1deeaf9d0 | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | 6fe59ed5d79f | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | b0652af9c8d0 | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | e3c9d6b4bc92 | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | de7256c7adcd | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | 08b1b7cb6a5b | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | 0cb31d0fc356 | go.mongodb.org/ | 1.17.7 | 1 |
| bitnamilegacy/ | 5bf82b98c82c | go.mongodb.org/ | 1.17.7 | 1 |
| bitnami/ | b3bd5b6be9a0 | go.mongodb.org/ | 1.17.7 | 1 |
| blipai/ | 737d5d19a312 | go.mongodb.org/ | 1.17.7 | 1 |
| bloomberg/ | 8520120f5598 | go.mongodb.org/ | 1.17.7 | 1 |
| breton/ | 41b1bb483aa2 | go.mongodb.org/ | 1.17.7 | 1 |
| cesanta/ | 98e0307e0d2d | go.mongodb.org/ | 1.17.7 | 1 |
| chaosnative/ | 72ee352bc333 | go.mongodb.org/ | 1.17.7 | 1 |
| chaosnative/ | 62cf6adc355e | go.mongodb.org/ | 1.17.7 | 1 |
| chaosnative/ | e7bcff4a20c0 | go.mongodb.org/ | 1.17.7 | 1 |
| chrislusf/ | 634b094b2183 | go.mongodb.org/ | 1.17.7 | 1 |
| chrislusf/ | ed80f00fde46 | go.mongodb.org/ | 1.17.7 | 1 |
| cloudentity/ | 9402ec4b5016 | go.mongodb.org/ | 1.17.7 | 1 |
| cloudentity/ | ee83cdd45b7b | go.mongodb.org/ | 1.17.7 | 1 |
| cloudentity/ | 5728654cecb7 | go.mongodb.org/ | 1.17.7 | 1 |
| cloudentity/ | 8ca94ae6acf4 | go.mongodb.org/ | 1.17.7 | 1 |
| cloudentity/ | c04eb10c77b7 | go.mongodb.org/ | 1.17.7 | 1 |
| codecov/ | de483faad6e5 | go.mongodb.org/ | 1.17.7 | 1 |
| coderenvs/ | 1deffc4670e6 | go.mongodb.org/ | 1.17.7 | 1 |
| coordimap/ | 7748fd0fae9f | go.mongodb.org/ | 1.17.7 | 1 |
| countly/ | e3c238248f99 | go.mongodb.org/ | 1.17.7 | 1 |
| daprio/ | 4be696707bd1 | go.mongodb.org/ | 1.17.7 | 1 |
| dasmeta/ | fa657960dfec | go.mongodb.org/ | 1.17.7 | 1 |
| datadog/ | aad9994de6a7 | go.mongodb.org/ | 1.17.7 | 1 |
| defactops/ | 825cdf9ba706 | go.mongodb.org/ | 1.17.7 | 1 |
| devopstales/ | 75136aa7a26e | go.mongodb.org/ | 1.17.7 | 1 |
| dongjiang1989/ | 2a3ead6a55dc | go.mongodb.org/ | 1.17.7 | 1 |
| dragonflyoss/ | c3ef7f10698d | go.mongodb.org/ | 1.17.7 | 1 |
| dragonflyoss/ | 523785c77787 | go.mongodb.org/ | 1.17.7 | 1 |
| engrmth/ | 6d8464e6f0e8 | go.mongodb.org/ | 1.17.7 | 1 |
| epamedp/ | 976a662a5e72 | go.mongodb.org/ | 1.17.7 | 1 |
| fluxninja/ | 356d7aa86632 | go.mongodb.org/ | 1.17.7 | 1 |
| galaxy/ | e50a890e24c9 | go.mongodb.org/ | 1.17.7 | 1 |