-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Nov 2026 16:12:33 -0500
Source: mongo-c-driver
Architecture: source
Version: 1.30.4-1+deb13u5
Distribution: trixie
Urgency: medium
Maintainer: Mongo C Driver Team <mongo-c-driver-debian@googlegroups.com>
Changed-By: Roberto C. Sanchez <roberto@connexer.com>
Changes:
 mongo-c-driver (1.30.4-1+deb13u5) trixie; urgency=medium
 .
   * Fix CVE-2026-84965: heap write primitive via size round-up wrap during JSON
     parsing on 32-bit builds
   * Fix CVE-2026-84963: silent field truncation via unchecked int cast of huge
     JSON string values in JSON-to-BSON parser
   * Fix CVE-2026-84964: heap corruption via OCSP request double free from
     crafted multi-URL certificate in TLS client
   * Fix CVE-2026-84969: heap overflow via truncated base64 encoding of binary
     fields in length-limited JSON output
   * Fix CVE-2026-88035: heap buffer overflow via wrapped size check during SASL
     username canonicalization
   * Fix CVE-2026-88036: GridFS data disclosure and deletion via query-operator
     injection in file IDs
   * Fix CVE-2026-93394: SCRAM nonce validation bypass
   * Fix CVE-2026-96746: heap buffer overflow via mid-scan command list growth
     in client topology monitoring
   * Fix CVE-2026-106428: out-of-bounds read in SCRAM authentication response
     parsing
   * Fix CVE-2026-106431: one-byte heap buffer overflow in BSON bulk document
     writer
   * Fix CVE-2026-106438: silent Decimal128 value corruption via incorrect
     exactness check
   * Fix CVE-2026-106437: out-of-bounds read and write via undersized BSON
     buffer reservation
   * Fix CVE-2026-120955: application abort on malformed GridFS metadata
   * Fix CVE-2026-120678: leaks the decompressed reply buffer when an
     OP_COMPRESSED reply fails to parse (denial of service)
   * Fix CVE-2026-120684: GridFS gap lets a shared writer recover a protected
     client's password
   * Fix CDRIVER-6401: abort in cursor namespace parsing when no dot separator
     (required by CVE-2026-120956 fix)
   * Fix CVE-2026-120956: remote abort and memory disclosure from a malformed
     cursor.ns
   * Fix CDRIVER-6523: mandate raising writeConcernError (change SHOULD to MUST)
     + this fixes a potential loss of data by ensuring that a WCE reported by
       the server is propagated rather than discarded
Checksums-Sha1:
 198ce94c9a6631a4f44808f6bfe3178a5f68367a 2734 mongo-c-driver_1.30.4-1+deb13u5.dsc
 a299f336a2475dea5f6fed6381960b6ddf08c49c 63016 mongo-c-driver_1.30.4-1+deb13u5.debian.tar.xz
 890a846264686f66f1158c14cc22b46527592f11 7217 mongo-c-driver_1.30.4-1+deb13u5_source.buildinfo
Checksums-Sha256:
 e8994919aba117a33a6370a419d7833301e005c8371a063e0fba20ab7ded4f7f 2734 mongo-c-driver_1.30.4-1+deb13u5.dsc
 bdc36cfad7c3766a145b35dbfba39762b03b829271f785eb7f9ae37f44ff957c 63016 mongo-c-driver_1.30.4-1+deb13u5.debian.tar.xz
 98c6dda31c104602f14814f12b833879f2d95a589d77f308601d505b4805a433 7217 mongo-c-driver_1.30.4-1+deb13u5_source.buildinfo
Files:
 184d4c9b2b16584efd054450389eff9d 2734 libs optional mongo-c-driver_1.30.4-1+deb13u5.dsc
 7e94dde9e70ea81e639f86b65a075f19 63016 libs optional mongo-c-driver_1.30.4-1+deb13u5.debian.tar.xz
 e7d8ea428e6c19ec8777cb50ee6cadaa 7217 libs optional mongo-c-driver_1.30.4-1+deb13u5_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEIYZ1DR4ae5UL01q7ldFmTdL1kUIFAmrqWg8ACgkQldFmTdL1
kUIphRAAkCtdbDQnFsuub5nIbaK9wBc3nDJ93RgTPJPlpW8JfxpvfLsal9FP0gjh
coPysMLlIApiJrYE4PACCMlN0PtrhzjSkUH4kV/9oGVGd3SaNTqAKptOnGotIZ10
2m7doB/AbOSJTDHK0y3C9Lofdp8YEo5DKufkwCSdUaaaHVVyFB38/fIzWjQ18Sor
plYNEPiFOZLAyx3mm+zglEuFTTE1hVhQCHzA3epzY5MoAUhSkWcKRIAYsPEI6v59
ly94Jj2R/ZmWqHZLf07koBRBETYQ3CrDQ7cOwBwU4N89Iwl9eyPCn7Qs+usGJBPm
XR8ICX26b39C3uI2ktLDp93b/POlm+MKdUd25Xr66BGNfVXwoQLb+o5kYOnFc06a
EN6Tyzu0kzZBzhDZgNzCMbaKENOb+Cg3GGs03gUE3vG+ncPR+osv5NMLS0bgGXW8
HQO8UHnpVBdUnhIVGbXHv57HaPPwzwGt05FQF2Uet+9vkIwvox3UTTIDGygfpLiH
DC/pQRsu+Ott9n/ppCRIRQqdtrbfxpKBVG3dxEVofLMaUKIWBxIeZogudGqfaqX9
yDCJhWZNRLmOa53IhdWvpJNfFr3bzjKsqK0VQo+qThn85ryRVaK+NzeAJmjbq600
ltSuqdogBr4C6wdZ+J5gbILGcQQNMWf3uKWU/XNUvbzGbSiF/Fs=
=+io/
-----END PGP SIGNATURE-----