An integer overflow in the MongoDB Go Driver causes a runtime panic when processing a malformed BSON document. This panic stops the application process, resulting in a denial of service. The vulnerability is a classic overflow condition that crashes the Go runtime during BSON value‑length validation.

The affected product is the MongoDB Go Driver. No specific version range is listed, so all current and future releases that have not yet applied the fix remain vulnerable until an update is applied.

The CVSS score of 8.2 indicates a high severity risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated actor who can provide malicious BSON bytes to a running application is likely to trigger the panic, leading to service interruption. The driver’s server‑monitoring path contains panic recovery, but it only mitigates failures during server selection, not the general application crash.