MongoDB Go Driver CVE-2026-107325

Exploitation requires that the affected application specifically call bson.RawArray.Validate or bsoncore.Array.Validate on raw BSON array data that an unauthenticated attacker can supply (e.g. an externally-reachable input path). The limiting factor captured by CVSS 4.0 AT:P is that applications which never invoke these Validate methods on untrusted input, or that recover from panics (e.g. via a recover() handler or a process supervisor that restarts the worker), are not exploitable or only momentarily disrupted. Impact is confined to process termination - the description explicitly rules out confidentiality and integrity impact - so the realistic blast radius is availability of the specific unprotected process only.

This is a denial-of-service-only vulnerability in the MongoDB Go Driver (CWE-129, improper validation of array index). The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.2, driven almost entirely by network reach, no authentication (PR:N), and high availability impact (VA:H) with zero confidentiality or integrity impact - consistent with the description's statement that only process termination occurs. The key tempering signal is AT:P (Attack Requirements: Present): exploitation is not universal against every deployment but conditional on the application actually calling bson.RawArray.Validate or bsoncore.Array.Validate on attacker-supplied raw BSON. No EPSS score, KEV listing, or POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' The 8.2 'High' rating reflects CVSS 4.0's weighting of unauthenticated network availability loss rather than a broadly weaponized threat - realistic priority is moderate: high for the specific subset of services that validate untrusted raw BSON arrays, low for the many applications that never invoke these Validate methods on external input. No conflicting signals were found, but EPSS and KEV data are simply absent rather than confirmed-negative, so widespread-exploitation likelihood cannot be independently quantified.

A Go service that accepts externally-supplied BSON (for example an API ingesting documents or a message consumer) passes attacker-controlled bytes to bson.RawArray.Validate or bsoncore.Array.Validate. The attacker sends a malformed four-byte array whose declared length triggers an out-of-bounds index, causing a runtime panic that crashes the unprotected process. No authentication is required (PR:N) and the attack is low-complexity to deliver over the network, though it only yields denial of service; no public exploit code was identified in the provided data.