CVE-2026-2303 — Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak

Affected: MongoDB Inc MongoDB Go Driver

The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

GHSA-995v-fvrw-c78m — opentelemetry-go's Schema ParseFile leaks file descriptors on each parse

Affected: Go: go.opentelemetry.io/otel/schema/v1.1, Go: go.opentelemetry.io/otel/schema/v1.0, Go: go.opentelemetry.io/otel/schema

### Summary

`go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. The severity is low because exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path.

Introduced in commit: e72a235

### Details

In `schema/v1.0/parser.go:41-47`, `ParseFile` opens the requested schema path with `os.Open` and then returns `Parse(file)` without a `defer file.Close()` or other close path:

```go file, err := os.Open(schemaFilePath) if err != nil { return nil, err } return Parse(file) ```

The validation evidence also identifies `schema/v1.0/parser.go:50-73`: `Parse` accepts an `io.Reader`, decodes from it, and does not close it. Ownership of the opened file is therefore not transferred to `Parse`, leaving the descriptor open until the Go runtime eventually finalizes the file object. With repeated `ParseFile` calls, descriptors can accumulate until the process receives `EMFILE` / "too many open files".

### PoC

[validation-artifact.zip](https://github.com/user-attachments/files/27494463/validation-artifact.zip)

The local artifact `validation-artifact.zip` contains:

- `leak_poc.go`: PoC source that repeatedly calls `schema.ParseFile("schema/v1.0/testdata…

Most recent entries from all

CVE-2026-2303 — Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak

GHSA-995v-fvrw-c78m — opentelemetry-go's Schema ParseFile leaks file descriptors on each parse