CVE-2026-2303
MediumAdvisory
Published 10 Feb 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.002
- 14th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 579
- of 17,787 indexed, latest versions
- Container images
- 607
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling
Carried by container images the latest versions of 579 of 17,787 indexed charts deploy, on 607 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.mongodb.org/ | v1.0.0, v1.0.3, v1.0.4, v1.1.0+54 more | 1.17.7 | 604 |
| go.mongodb.org/ | v2.2.2, v2.3.0, v2.3.1, v2.4.0 | 2.4.2 | 12 |
- OSV records
- GHSA-cp6g-7hqx-qxhp
- Also known as
- GO-2026-5327
Charts affected
579 by stars
Container images carrying it
607 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| silkeh/ | 900010497f8c | go.mongodb.org/ | 1.17.7 | 1 |
| simpleidserver/ | 25e378d57d78 | go.mongodb.org/ | 1.17.7 | 1 |
| sky5367/ | d51bf68d4b26 | go.mongodb.org/ | 1.17.7 | 1 |
| springhack/ | 4aceb821da88 | go.mongodb.org/ | 1.17.7 | 1 |
| streamnative/ | 31533fa9fab7 | go.mongodb.org/ | 1.17.7 | 1 |
| superorbital/ | d59732f61d6e | go.mongodb.org/ | 1.17.7 | 1 |
| svtechnmaa/ | 1d71314424aa | go.mongodb.org/ | 1.17.7 | 1 |
| thanosio/ | 88276fcd1491 | go.mongodb.org/ | 1.17.7 | 1 |
| thanosio/ | b12d5c31bf5a | go.mongodb.org/ | 1.17.7 | 1 |
| thesisrobot/ | d94c8dbf6dac | go.mongodb.org/ | 1.17.7 | 1 |
| twentycrm/ | 2f78405a78be | go.mongodb.org/ | 1.17.7 | 1 |
| udhos/ | 3acc0e7599bf | go.mongodb.org/ | 1.17.7 | 1 |
| udhos/ | 03b08b63f524 | go.mongodb.org/ | 1.17.7 | 1 |
| uptrace/ | 34a02c3b2d12 | go.mongodb.org/ | 1.17.7 | 1 |
| wait4x/ | 4dcd86307de1 | go.mongodb.org/ | 1.17.7 | 1 |
| zabbix/ | 7322a94c5d7a | go.mongodb.org/ | 1.17.7 | 1 |
| gcr.io/ | 5a0884f9a90c | go.mongodb.org/ | 1.17.7 | 1 |
| gcr.io/ | 39661bd823e8 | go.mongodb.org/ | 1.17.7 | 1 |
| gcr.io/ | dc6ca05bb94f | go.mongodb.org/ | 1.17.7 | 1 |
| gcr.io/ | 293941ee4f65 | go.mongodb.org/ | 1.17.7 | 1 |
| gcr.io/ | 83e79c709df3 | go.mongodb.org/ | 1.17.7 | 1 |
| gcr.io/ | 00db9796a37b | go.mongodb.org/ | 1.17.7 | 1 |
| gcr.io/ | 109ac1b38c41 | go.mongodb.org/ | 1.17.7 | 1 |
| gcr.io/ | 795a0c8a0e13 | go.mongodb.org/ | 1.17.7 | 1 |
| gcr.io/ | f7e67e0bc071 | go.mongodb.org/ | 1.17.7 | 1 |
| gcr.io/ | 784518ff3ee7 | go.mongodb.org/ | 1.17.7 | 1 |
| gcr.io/ | 82940e8c3e0d | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 459010a02aff | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 62c44a384e13 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 744bc929a579 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 2f06e72cef36 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 36ce246d884e | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 6b99ee9feece | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 9ab9a675c405 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 9f8896ffc15b | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 835b72878606 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | e2b8aa62b648 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | fce5b6fd161c | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | cab66a6b3574 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 69b55a1c1c5d | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | e159ba41aede | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 7c776499b8c9 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 073116e61007 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 2f5be9cde5f9 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 56a1ea4490ba | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 9440a40b3947 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | ec40c3d9c48f | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 5706414241eb | go.mongodb.org/ go.mongodb.org/ | 1.17.7 2.4.2 | 1 |
| ghcr.io/ | 00cd9316a379 | go.mongodb.org/ | 1.17.7 | 1 |
| ghcr.io/ | 24a0113d5fb0 | go.mongodb.org/ | 1.17.7 | 1 |