Warning
Go Driver versions v1.0.0 through v1.17.9 and v2.0.0 through v2.9.0 are affected by a security issue CVE-2026-88031 in the GridFS delete methods. This release resolves that security issue in Go Driver v1. Users are encouraged to upgrade to Go Driver v1.17.10 as soon as possible. For the fix in Go Driver v2, see the v2.9.1 release.
The MongoDB Go Driver Team is pleased to release version 1.17.10 of the MongoDB Go Driver.
This release addresses CVE-2026-88031, a security issue in GridFS delete methods where the file ID lookup could match more loosely than intended, potentially causing unintended file (and chunk) deletions instead of an exact match on the given file ID. For more information please see the 1.17.10 release notes.
You can obtain the driver source from GitHub under the v1.17.10 tag.
Documentation for the Go Driver can be found on pkg.go.dev and the
BSON library documentation is also available on pkg.go.dev.
For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow.
Bugs can be reported in the Go Driver project in the MongoDB JIRA
where a list of current issues can be found.
Your feedback on the Go Driver is greatly appreciated!
Thank you,
The Go Driver Team