The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and
    macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect
    assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be
    null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
    (CVE-2026-2303)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4408-1 advisory.

    - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error     Handling       (bsc#1269861).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276742).
    - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can     lead to       exfiltration of sensitive data (bsc#1267482).
    - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause     a DoS       (bsc#1267483).
    - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and     can cause OBI       out-of-bounds reads to leak memory into telemetry (bsc#1267484).
    - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel     memory and cause       that memory to be copied into telemetry (bsc#1267486).
    - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-     segment calls to       read and overwrite memory beyond the first segment (bsc#1267487).
    - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the     size of a       parameter value overflows the message buffer (bsc#1272418).
    - CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the     ebpf-profiler       agent (bsc#1268982).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272028).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278671).
    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276982).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276992).
    - CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing     users who can       modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through     `bearerTokenFile`       (bsc#1277429).
    - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated     database name in       Client.BulkWrite (bsc#1278693).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280671).

    Changes for alloy:

    - Update to version 1.19.2.
    - Update to version 1.19.1.
    - Update to version 1.19.0:
     * BREAKING CHANGE: prometheus.operator.servicemonitors now      rejects endpoints that reference local files by default. Set      allow_arbitrary_file_access = true to preserve previous      behavior.
     * prometheus.enrich: Support multi-label matching
     * prometheus.relabel: Add opt-in TTL cache mode
     * telemetry: Add new metrics for graph connections and      pyroscope forwarded entries
     * database_observability: Exclude system schemas from MySQL      health checks and redact query text in explain_plans
    - Update to version 1.18.1:
     * Add nop receiver to OTel Engine

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21276-1 advisory.

    Changes in apptainer:

    - Enable building of SUID starter for SLES 15 (jsc#PED-16347).
      * Security fix for CVE-2026-2303 (bsc#1270529):
        Heap Out-of-Bounds Read in GSSAPI Error Handling in         go.mongodb.org/mongo-driver. The dependency on mongo-driver         has been removed with this version of apptainer.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- RU-2026:2815-1 advisory.

    Security fixes included on this update:

    - CVE-2026-2303: go.mongodb.org/mongo-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling     (bsc#1270529).

    Other fixes:

    - Enable building of SUID starter for SLES 15 (jsc#PED-16347).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
458117	Echo: multiple go.mongodb.org/mongo-driver packages: security update to 1.17.7	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458117	Echo: multiple go.mongodb.org/mongo-driver packages: security update to 1.17.7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
362571	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:4408-1)	Nessus	SuSE Local Security Checks	Local	high
326417	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:21276-1)	Nessus	SuSE Local Security Checks	Local	medium
326323	SUSE SLES15: Multiple Vulnerabilities (SUSE-RU-2026:2815-1)	Nessus	SuSE Local Security Checks	Local	medium
443526	SCA: security update for go.mongodb.org/mongo-driver, go.mongodb.org/mongo-driver/v2 (GHSA-cp6g-7hqx-qxhp)	Tenable Cloud Security	SCA Checks	Local	medium
443526	SCA: security update for go.mongodb.org/mongo-driver, go.mongodb.org/mongo-driver/v2 (GHSA-cp6g-7hqx-qxhp)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-2303

medium

Tenable Plugins

medium

medium

high

medium

medium

medium

medium