-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Nov 2026 16:12:33 -0500
Source: mongo-c-driver
Binary: libbson-1.0-0t64 libbson-1.0-0t64-dbgsym libbson-dev libmongoc-1.0-0t64 libmongoc-1.0-0t64-dbgsym libmongoc-dev
Architecture: amd64
Version: 1.30.4-1+deb13u5
Distribution: trixie
Urgency: medium
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) <buildd_amd64-x86-conova-01@buildd.debian.org>
Changed-By: Roberto C. Sanchez <roberto@connexer.com>
Description:
 libbson-1.0-0t64 - Library to parse and generate BSON documents - runtime files
 libbson-dev - Library to parse and generate BSON documents - dev files
 libmongoc-1.0-0t64 - MongoDB C client library - runtime files
 libmongoc-dev - MongoDB C client library - dev files
Changes:
 mongo-c-driver (1.30.4-1+deb13u5) trixie; urgency=medium
 .
   * Fix CVE-2026-84965: heap write primitive via size round-up wrap during JSON
     parsing on 32-bit builds
   * Fix CVE-2026-84963: silent field truncation via unchecked int cast of huge
     JSON string values in JSON-to-BSON parser
   * Fix CVE-2026-84964: heap corruption via OCSP request double free from
     crafted multi-URL certificate in TLS client
   * Fix CVE-2026-84969: heap overflow via truncated base64 encoding of binary
     fields in length-limited JSON output
   * Fix CVE-2026-88035: heap buffer overflow via wrapped size check during SASL
     username canonicalization
   * Fix CVE-2026-88036: GridFS data disclosure and deletion via query-operator
     injection in file IDs
   * Fix CVE-2026-93394: SCRAM nonce validation bypass
   * Fix CVE-2026-96746: heap buffer overflow via mid-scan command list growth
     in client topology monitoring
   * Fix CVE-2026-106428: out-of-bounds read in SCRAM authentication response
     parsing
   * Fix CVE-2026-106431: one-byte heap buffer overflow in BSON bulk document
     writer
   * Fix CVE-2026-106438: silent Decimal128 value corruption via incorrect
     exactness check
   * Fix CVE-2026-106437: out-of-bounds read and write via undersized BSON
     buffer reservation
   * Fix CVE-2026-120955: application abort on malformed GridFS metadata
   * Fix CVE-2026-120678: leaks the decompressed reply buffer when an
     OP_COMPRESSED reply fails to parse (denial of service)
   * Fix CVE-2026-120684: GridFS gap lets a shared writer recover a protected
     client's password
   * Fix CDRIVER-6401: abort in cursor namespace parsing when no dot separator
     (required by CVE-2026-120956 fix)
   * Fix CVE-2026-120956: remote abort and memory disclosure from a malformed
     cursor.ns
   * Fix CDRIVER-6523: mandate raising writeConcernError (change SHOULD to MUST)
     + this fixes a potential loss of data by ensuring that a WCE reported by
       the server is propagated rather than discarded
Checksums-Sha1:
 2ec6329c0e04d0b014c7af126be547fff34f0264 314100 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_amd64.deb
 e63d44dd55fbe2670bead9930c4053fceeaf041c 90152 libbson-1.0-0t64_1.30.4-1+deb13u5_amd64.deb
 de0772bc4240675ccab6af7d31aadc9d8a66a032 152340 libbson-dev_1.30.4-1+deb13u5_amd64.deb
 7af0dea92355a682538d9ea36eb2df5171135a0a 1668872 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_amd64.deb
 355074f5beabb3b45744fbdb3402afc50714814d 394800 libmongoc-1.0-0t64_1.30.4-1+deb13u5_amd64.deb
 e91731e03912befd3610ec7a1e8dfb5e904bcabb 472148 libmongoc-dev_1.30.4-1+deb13u5_amd64.deb
 f009433e233c6ea1680e64d336cd7aca6781ea03 10527 mongo-c-driver_1.30.4-1+deb13u5_amd64-buildd.buildinfo
Checksums-Sha256:
 920907725da2cd7253d0b1afa6f3f75fb9c07db57028c214d6fe12987d68b0f9 314100 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_amd64.deb
 c3973dd860196b7581e4997d2bbd1804e63a756ac25b439c2ac45ab297dd3da5 90152 libbson-1.0-0t64_1.30.4-1+deb13u5_amd64.deb
 4ad2fd65decaedf2469663d358a1edfb88d99490171c8a4b1ec3dbfccc767723 152340 libbson-dev_1.30.4-1+deb13u5_amd64.deb
 55a0938651d0d3dec961d57dd3040fb5a0fa2377a8e0f318f882e49fd19adb56 1668872 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_amd64.deb
 e9371dbdca22a4d582e4cb64fe592f468fb4b871bf5257f2583dc1d8ba459b68 394800 libmongoc-1.0-0t64_1.30.4-1+deb13u5_amd64.deb
 da0316aa93dcbb8f050558540c9646b8e5d4ef7529d140df5d6487c34174f631 472148 libmongoc-dev_1.30.4-1+deb13u5_amd64.deb
 a9bedbcad328d791af107144edb8ea73cbb5cbf7a49ab4ae10a7bf4e8f1c4357 10527 mongo-c-driver_1.30.4-1+deb13u5_amd64-buildd.buildinfo
Files:
 74b2979ca34fe5fd262379ef11b90a0f 314100 debug optional libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_amd64.deb
 9067f0c863fb8ced483c9bff575a3b4b 90152 libs optional libbson-1.0-0t64_1.30.4-1+deb13u5_amd64.deb
 607508b7d56813e291c9ac1a1bc2a9ba 152340 libdevel optional libbson-dev_1.30.4-1+deb13u5_amd64.deb
 8a0aa1db66622c013a172c679697e4ac 1668872 debug optional libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_amd64.deb
 cb04c04339277f1f349c1d5ca4a27d18 394800 libs optional libmongoc-1.0-0t64_1.30.4-1+deb13u5_amd64.deb
 e9128f50294462b2bf99154e677157b4 472148 libdevel optional libmongoc-dev_1.30.4-1+deb13u5_amd64.deb
 520945c34ecc21bcf16971277a182fd4 10527 libs optional mongo-c-driver_1.30.4-1+deb13u5_amd64-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmr46DkACgkQPkCWRKsh
20eszw//eFKmWOh8/7NUuLrVsKFPDO6XjBGQvLa3vEfKg+KhSlD294oWbXFi00aN
wmCA+bK1r9uzXv/p6iBKkzHTcrU9gEp59rMjtfnkMmh94cJltjYcRQghC0LNDl+n
bAhpoYzYRPtKKlMWbURxMlNBv7QkCgdYnkuPHe8zIU8yBRXP1fZor9MfeO6v147x
fKk7OshQTaAAPl5/sH8yFnjdk7PBzp0LYflZfJZh4fPof7jkt1NCZX+feg5SU+ME
DnHwSkfORkZiX1akaoPwwBrQ9gKqhXAKHTQ/YmXoDqwAIY+HvJ/pgiYb4W49WfoX
2qvf/+E+oPpFo1++l4uYrjH3hbT8Yu+iGxhJC3IluiHkjwaZOCWRFNc3E9FKekf6
kJg2ppk9YSzUc02bwqt4svoz1ETn314lUP52v8DXbV7wlXajA5qE3Wpd0DxktJSM
IU4Z48RugzTAMxV9oqChwEtA/vLcxSODInBg6+kmlULfJOI2h7PgInwFEh8iXKdk
m0O1Pm7qI7i9rHdjIqvHHB4rpzAlHXSvO0kS/b/wkoHF09mZWWFD56886LRo4xsa
H5I+rYuLga2YtO+lC0XZq5oWjSOK2k3ELWGJ/kWhkGUScxA9JjfLqht+17KGuvaG
aUh/QiFDOaSniZlHkGBY+JeyFBa49KAsB71qHhSlm/PxgCvrAEw=
=BuMf
-----END PGP SIGNATURE-----