Is go.mongodb.org/mongo-driver/v2 safe ? 1 known vulnerability, worst severity MODERATE.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
epss chance of exploitation in 30 days, 13th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-cp6g-7hqx-qxhp, the advisory selected below
// 1 advisories GHSA-cp6g-7hqx-qxhp The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocat MODE The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
// cvss v4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Attack vector Network
Attack complexity Low
Attack requirements None
Privileges required Low
User interaction Passive
Confidentiality (vulnerable system) None
Integrity (vulnerable system) High
Availability (vulnerable system) None
Confidentiality (subsequent systems) None
Integrity (subsequent systems) None
Availability (subsequent systems) None Checked 2026-09-26 at 01:03 UTC. The most recent advisory here was published 2026-02-10. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page