[Git][security-tracker-team/security-tracker][master] Add another batch of mongodb driver CVEs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
36045798 by Salvatore Bonaccorso at 2026-10-09T20:41:19+02:00
Add another batch of mongodb driver CVEs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -813,13 +813,27 @@ CVE-2026-106432 (The BSON encoder in the MongoDB PHP Driver converts a string le
 	NOTE: https://jira.mongodb.org/browse/PHPC-2741
 	NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260 (2.5.4, 2.1.11, 1.21.11)
 CVE-2026-106431 (An off-by-one error in the BSON bulk document writer in the MongoDB C  ...)
-	TODO: check
+	- mongo-c-driver 2.5.6-1
+	NOTE: https://jira.mongodb.org/browse/CDRIVER-6418
+	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/bddaffdabdb449d8ee5e8b28f9a82afd03cd42aa (2.5.6)
+	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/70d96b8f28974e02cc966a00953dc3d8c308b8ff (1.30.13)
 CVE-2026-106430 (The MongoDB C++ Driver discards content after an embedded NUL byte in  ...)
-	TODO: check
+	- mongo-cxx-driver 4.6.1-1
+	NOTE: https://jira.mongodb.org/browse/CXX-3551
+	NOTE: https://jira.mongodb.org/browse/CXX-3552
+	NOTE: Fixed by: https://github.com/mongodb/mongo-cxx-driver/commit/dabc8ff93b616747c64007183f04399d9636468d (4.6.0)
+	NOTE: Fixed by: https://github.com/mongodb/mongo-cxx-driver/commit/5a6efb4ae260a3dd6d243a1a1b1e4d788e392416 (4.6.1)
 CVE-2026-106429 (An integer underflow in the KMS endpoint-parsing logic of MongoDB libm ...)
-	TODO: check
+	- libmongocrypt 1.20.5-1
+	NOTE: https://jira.mongodb.org/browse/MONGOCRYPT-986
+	NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/f2ea9f97dff40eb8b470a4fc3d407bafb4650d88 (1.20.5)
+	NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/1450714452daaaa9da29359ab6a6b1a0c3a1fa47 (1.20.5)
+	NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/03d09f07bb32f9387aec823444cd7bb6d41cddad (1.20.5)
 CVE-2026-106428 (An out-of-bounds read in SCRAM authentication response parsing in the  ...)
-	TODO: check
+	- mongo-c-driver 2.4.0-1
+	NOTE: https://jira.mongodb.org/browse/CDRIVER-6370
+	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/9655909e15c83149c0fc68e53f38e696bbd23569 (2.4.0)
+	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/57054353fdf79383341de21540a2adab196eb6a4 (1.30.13)
 CVE-2026-106177 (A kernel buffer overflow vulnerability in HP Sure Click versions prior ...)
 	TODO: check
 CVE-2026-106126 (A command injection vulnerability in the Active Directory Events Liste ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3604579884e9e01d0174af27bb1d3e600f0b589c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3604579884e9e01d0174af27bb1d3e600f0b589c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/d59645ad/attachment-0001.htm>