BSON field injection via unchecked cstrings

Improper input validation in MongoDB Go Driver 1.0 through 1.5.0 allows remote authenticated users to inject BSON fields via crafted Go objects. BSON marshaling accepts cstrings containing null bytes in element keys or regular-expression fields, allowing terminator truncation and insertion of attacker-controlled fields into serialized documents. Exploitation requires authenticated access to an application that marshals attacker-influenced objects; the resulting impact is unauthorized document-field modification rather than code execution or service shutdown.