CVE-2026-2303
MediumAdvisory
Published 10 Feb 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.002
- 14th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 581
- of 17,781 indexed, latest versions
- Container images
- 608
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling
Carried by container images the latest versions of 581 of 17,781 indexed charts deploy, on 608 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.mongodb.org/ | v1.0.0, v1.0.3, v1.0.4, v1.1.0+54 more | 1.17.7 | 605 |
| go.mongodb.org/ | v2.2.2, v2.3.0, v2.3.1, v2.4.0 | 2.4.2 | 12 |
- OSV records
- GHSA-cp6g-7hqx-qxhp
- Also known as
- GO-2026-5327
Charts affected
581 by stars
Container images carrying it
608 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| minio/ | 14cea493d9a3 | go.mongodb.org/ | 1.17.7 | 16 |
| library/ | 8e70544b6c76 | go.mongodb.org/ | 1.17.7 | 10 |
| quay.io/ | 1dce27c494a1 | go.mongodb.org/ | 1.17.7 | 8 |
| quay.io/ | e13b6ed5cb92 | go.mongodb.org/ | 1.17.7 | 8 |
| quay.io/ | 4ec6df40fdb9 | go.mongodb.org/ | 1.17.7 | 7 |
| bitnamilegacy/ | 42319decb591 | go.mongodb.org/ | 1.17.7 | 6 |
| quay.io/ | fbeaef7a8566 | go.mongodb.org/ | 1.17.7 | 6 |
| quay.io/ | 24a5204b418e | go.mongodb.org/ | 1.17.7 | 6 |
| quay.io/ | 959d47672fbf | go.mongodb.org/ | 1.17.7 | 6 |
| library/ | 4be76f674fc4 | go.mongodb.org/ | 1.17.7 | 5 |
| prom/ | 7e4e9f7a0954 | go.mongodb.org/ | 1.17.7 | 5 |
| prom/ | 0a8caa2e9f19 | go.mongodb.org/ | 1.17.7 | 5 |
| quay.io/ | 9ab73a421b65 | go.mongodb.org/ | 1.17.7 | 5 |
| grafana/ | 1ee60f980950 | go.mongodb.org/ | 1.17.7 | 4 |
| grafana/ | 3c8fd3570dd9 | go.mongodb.org/ | 1.17.7 | 4 |
| grafana/ | 65a578975943 | go.mongodb.org/ | 1.17.7 | 4 |
| library/ | 6efa05203990 | go.mongodb.org/ | 1.17.7 | 4 |
| ghcr.io/ | 5d1182ac21f0 | go.mongodb.org/ | 1.17.7 | 4 |
| ghcr.io/ | 6d4c9fe66e4f | go.mongodb.org/ | 1.17.7 | 4 |
| ghcr.io/ | 824d6d78d451 | go.mongodb.org/ | 1.17.7 | 4 |
| ghcr.io/ | ab2e1fa19dd4 | go.mongodb.org/ | 1.17.7 | 4 |
| quay.io/ | fd4d9a3dd1fd | go.mongodb.org/ | 1.17.7 | 4 |
| quay.io/ | b567818fe608 | go.mongodb.org/ | 1.17.7 | 4 |
| argoproj/ | 830e86cacefd | go.mongodb.org/ | 1.17.7 | 3 |
| bitnamilegacy/ | 016dce036593 | go.mongodb.org/ | 1.17.7 | 3 |
| cloudpirates/ | 8dc02a7e5093 | go.mongodb.org/ | 1.17.7 | 3 |
| derailed/ | 8e68e22c7663 | go.mongodb.org/ | 1.17.7 | 3 |
| grafana/ | 00568d89c4f8 | go.mongodb.org/ | 1.17.7 | 3 |
| grafana/ | 0dc5a246ab16 | go.mongodb.org/ | 1.17.7 | 3 |
| grafana/ | a0f881232a6f | go.mongodb.org/ | 1.17.7 | 3 |
| grafana/ | 58a6c186ce78 | go.mongodb.org/ | 1.17.7 | 3 |
| grafana/ | 0dac7d5cb383 | go.mongodb.org/ | 1.17.7 | 3 |
| migrate/ | cc4ad8e19d66 | go.mongodb.org/ | 1.17.7 | 3 |
| prom/ | d5155cfac40a | go.mongodb.org/ | 1.17.7 | 3 |
| prom/ | 565ee8650122 | go.mongodb.org/ | 1.17.7 | 3 |
| prom/ | bfad037f95e5 | go.mongodb.org/ | 1.17.7 | 3 |
| ghcr.io/ | 814117b0fd6d | go.mongodb.org/ | 1.17.7 | 3 |
| quay.io/ | 98580969b333 | go.mongodb.org/ | 1.17.7 | 3 |
| quay.io/ | 361db356b330 | go.mongodb.org/ | 1.17.7 | 3 |
| quay.io/ | d55631c7a740 | go.mongodb.org/ | 1.17.7 | 3 |
| quay.io/ | ab4f480f2cc6 | go.mongodb.org/ | 1.17.7 | 3 |
| quay.io/ | 1a3e9a878e50 | go.mongodb.org/ | 1.17.7 | 3 |
| quay.io/ | 378f4e037035 | go.mongodb.org/ | 1.17.7 | 3 |
| quay.io/ | 38d40a760569 | go.mongodb.org/ | 1.17.7 | 3 |
| quay.io/ | 7571a304e67f | go.mongodb.org/ | 1.17.7 | 3 |
| quay.io/ | a8779cfe553e | go.mongodb.org/ | 1.17.7 | 3 |
| quay.io/ | f5c29683a301 | go.mongodb.org/ | 1.17.7 | 3 |
| abutaha/ | 190ed2d1dfc8 | go.mongodb.org/ | 1.17.7 | 2 |
| alpine/ | 048f8d9c8cc7 | go.mongodb.org/ | 1.17.7 | 2 |
| assistiot/ | ad8f72108636 | go.mongodb.org/ | 1.17.7 | 2 |