[Git][security-tracker-team/security-tracker][master] Add CVE-2026-10732{4,5}/golang-mongodb-mongo-driver

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9a58f5a7 by Salvatore Bonaccorso at 2026-10-09T19:29:15+02:00
Add CVE-2026-10732{4,5}/golang-mongodb-mongo-driver

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -719,9 +719,13 @@ CVE-2026-107333 (Malcolm's nginx based reverse proxy contains a URL path normali
 CVE-2026-107332 (Insecure file permissions in the CodeCatalyst connection handler in AW ...)
 	NOT-FOR-US: Amazon
 CVE-2026-107325 (Improper validation of a BSON array length in the MongoDB Go Driver ca ...)
-	TODO: check
+	- golang-mongodb-mongo-driver <unfixed>
+	NOTE: https://jira.mongodb.org/browse/GODRIVER-4136
+	NOTE: Fixed by: https://github.com/mongodb/mongo-go-driver/commit/a0973940ec32f31e406ca4a5d7db03288bb628dc (v2.9.2)
 CVE-2026-107324 (An integer overflow in BSON value-length handling in the MongoDB Go Dr ...)
-	TODO: check
+	- golang-mongodb-mongo-driver <unfixed>
+	NOTE: https://jira.mongodb.org/browse/GODRIVER-4102
+	NOTE: Fixed by: https://github.com/mongodb/mongo-go-driver/commit/6e5eff3ea7bc5b6743f9fcec6bb8d523b0c98bbc (v2.9.2)
 CVE-2026-107322 (An incomplete list of disallowed inputs in Amazon Agent Plugins for AW ...)
 	NOT-FOR-US: Amazon
 CVE-2026-107318 (@fastify/reply-from is a Fastify plugin that forwards requests to an u ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9a58f5a765dfee65c93bd16f4ae32c0252a889ed

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9a58f5a765dfee65c93bd16f4ae32c0252a889ed
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/4d35987b/attachment.htm>