-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Nov 2026 16:12:33 -0500
Source: mongo-c-driver
Binary: libbson-doc libmongoc-doc
Architecture: all
Version: 1.30.4-1+deb13u5
Distribution: trixie
Urgency: medium
Maintainer: all / amd64 / i386 Build Daemon (x86-grnet-03) <buildd_amd64-x86-grnet-03@buildd.debian.org>
Changed-By: Roberto C. Sanchez <roberto@connexer.com>
Description:
 libbson-doc - Library to parse and generate BSON documents - documentation
 libmongoc-doc - MongoDB C client library - documentation
Changes:
 mongo-c-driver (1.30.4-1+deb13u5) trixie; urgency=medium
 .
   * Fix CVE-2026-84965: heap write primitive via size round-up wrap during JSON
     parsing on 32-bit builds
   * Fix CVE-2026-84963: silent field truncation via unchecked int cast of huge
     JSON string values in JSON-to-BSON parser
   * Fix CVE-2026-84964: heap corruption via OCSP request double free from
     crafted multi-URL certificate in TLS client
   * Fix CVE-2026-84969: heap overflow via truncated base64 encoding of binary
     fields in length-limited JSON output
   * Fix CVE-2026-88035: heap buffer overflow via wrapped size check during SASL
     username canonicalization
   * Fix CVE-2026-88036: GridFS data disclosure and deletion via query-operator
     injection in file IDs
   * Fix CVE-2026-93394: SCRAM nonce validation bypass
   * Fix CVE-2026-96746: heap buffer overflow via mid-scan command list growth
     in client topology monitoring
   * Fix CVE-2026-106428: out-of-bounds read in SCRAM authentication response
     parsing
   * Fix CVE-2026-106431: one-byte heap buffer overflow in BSON bulk document
     writer
   * Fix CVE-2026-106438: silent Decimal128 value corruption via incorrect
     exactness check
   * Fix CVE-2026-106437: out-of-bounds read and write via undersized BSON
     buffer reservation
   * Fix CVE-2026-120955: application abort on malformed GridFS metadata
   * Fix CVE-2026-120678: leaks the decompressed reply buffer when an
     OP_COMPRESSED reply fails to parse (denial of service)
   * Fix CVE-2026-120684: GridFS gap lets a shared writer recover a protected
     client's password
   * Fix CDRIVER-6401: abort in cursor namespace parsing when no dot separator
     (required by CVE-2026-120956 fix)
   * Fix CVE-2026-120956: remote abort and memory disclosure from a malformed
     cursor.ns
   * Fix CDRIVER-6523: mandate raising writeConcernError (change SHOULD to MUST)
     + this fixes a potential loss of data by ensuring that a WCE reported by
       the server is propagated rather than discarded
Checksums-Sha1:
 2b49a3091d99983a886705c8f74fab961d5c89f4 366744 libbson-doc_1.30.4-1+deb13u5_all.deb
 568b0861caf836648f1509817e8f9a8ec677e2c5 1405432 libmongoc-doc_1.30.4-1+deb13u5_all.deb
 3f701dc2d130ba5e0a4b7d105b4b8a85c2b68d57 9196 mongo-c-driver_1.30.4-1+deb13u5_all-buildd.buildinfo
Checksums-Sha256:
 fdc6fd4be2f6cb714ae1881908844dddd15f5ff409a4070d395b3faac8f727a7 366744 libbson-doc_1.30.4-1+deb13u5_all.deb
 6d621ec0ba63782deb97b1ce4b5b3da00a7eea6d37e536a2db59303624517321 1405432 libmongoc-doc_1.30.4-1+deb13u5_all.deb
 6a6c97edabf8e0b95f4a45f3527985ca88ead92de74b26bdff23ca97c207f56d 9196 mongo-c-driver_1.30.4-1+deb13u5_all-buildd.buildinfo
Files:
 b5be2f11056fa5e0f594ab362e866b47 366744 doc optional libbson-doc_1.30.4-1+deb13u5_all.deb
 51e63054afbce70b9ddda628817065fb 1405432 doc optional libmongoc-doc_1.30.4-1+deb13u5_all.deb
 5e9d0a9ff2f1ae2eb739a8a9b4eb57fc 9196 libs optional mongo-c-driver_1.30.4-1+deb13u5_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE5ZI1lXv5WjhHIVjsN8Ugyu9dQiQFAmr46HYACgkQN8Ugyu9d
QiQeQQ//azNd2amecpvoTX8TH16fyvanbnGZ5jE4H0498WlNjvN6WsRPzD8YkpDf
a96SzPigRsJgZ7lENA+fCDowiRSNiXuOALm5KAXkgndIVLQjZnMLX+WdZYNOLDIT
pQrrd5GoR4Qlbm9dCgyGIHYzjPsHwJ3toxcNTAlCBsfdcnX1SEhj6mBmXcQ5jKFb
uzg9OgGv5R4TJEIUJvmB0cBY1rOnFjw3KFQs8Dr5VGoo4QZvsrnXUQq6Aqj1OT77
hsHPcCkMMgN+/XE5/PTF/SSx0dz8UuJQBmmPX3mQb88HldXKDM3rpx5pUtQy4HLM
VK/x8SyvtBpqEwsYtMXjYXPRoVDIdYCPWEsw3/LV2SrqV981/jB/z29g79dszz6x
BFIG8RkWrcl/J282sbP3jRqyg2vHdq9vGR+wlyfralS+OoiCGnExmCegE3HDQ99Z
jk4VsFMfOnpxph0KXJF/TCm1HIIk1aLglS5mam/lZOMcb4pmB9JVW5/mV/2Pmdph
L4YnMnb6wNHJPE+tkOkecDVIyFCjodRc3oGykZ2YH0RTN4CIt6G00owQqGztE09m
voRqD/y4P5eRkJjWag41DEK4Ry7Jo7/lXITd56tuGxndeHiTgrgPwIxxcRjU8obe
CWxfsL6FNMh6GXXV3HV59nMnIVqPv5xtzBrTJE/vKirOE3iEhNg=
=IWuQ
-----END PGP SIGNATURE-----