Your message dated Thu, 1 Oct 2026 10:21:29 +0200
with message-id <[email protected]>
and subject line Re: Accepted php-mongodb 2.5.3-1 (source) into unstable
has caused the Debian Bug report #1148966,
regarding php-mongodb: CVE-2026-96745
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148966: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148966
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: php-mongodb
Version: 2.1.0-1
Severity: important
Tags: security upstream
Forwarded: https://jira.mongodb.org/browse/PHPC-2743
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for php-mongodb.
CVE-2026-96745[0]:
| Deserialization of untrusted data in the command monitoring support
| of the MongoDB PHP Driver can cause class names embedded in document
| content to be honored when the driver builds monitoring event
| objects. When an application registers a command monitoring
| subscriber and includes untrusted data in a database operation, an
| unauthenticated party who controls that data may cause an
| application class implementing the driver's persistable interface to
| be instantiated and its unserialization method invoked with the
| supplied data. The resulting impact depends on the classes available
| in the application.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-96745
https://www.cve.org/CVERecord?id=CVE-2026-96745
[1]
https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c
[2] https://jira.mongodb.org/browse/PHPC-2743
[3] https://github.com/mongodb/mongo-php-driver/pull/2115
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: php-mongodb
Source-Version: 2.5.3-1
On Thu, Oct 01, 2026 at 06:19:09AM +0000, Debian FTP Masters wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Format: 1.8
> Date: Sat, 26 Sep 2026 12:33:28 +0200
> Source: php-mongodb
> Architecture: source
> Version: 2.5.3-1
> Distribution: unstable
> Urgency: medium
> Maintainer: Debian PHP PECL Maintainers <[email protected]>
> Changed-By: Ondřej Surý <[email protected]>
> Changes:
> php-mongodb (2.5.3-1) unstable; urgency=medium
> .
> * New upstream version 2.5.3
> + [CVE-2026-96745]: Deserialization of untrusted data in the command
> monitoring support of the MongoDB PHP Driver can cause class names
> embedded in document content to be honored when the driver builds
> monitoring event objects.
> + [CVE-2026-6811]: Stack exhaustion vulnerability in the MongoDB PHP
> driver can cause application crashes when processing deeply nested
> BSON documents in unusual circumstances when the source of these BSON
> documents is not MongoDB Server.
> + [CVE-2026-84968]: An out-of-bounds read in the BSON decoding
> component of the MongoDB PHP driver may allow an unauthenticated
> party who supplies specially formed input to have a small amount of
> adjacent process memory copied into an error message that is returned
> to application code. This may result in unintended disclosure of
> limited memory contents.
> Checksums-Sha1:
> cb5d0f45e09d4328a56b4da338b71b9de9bf657c 2374 php-mongodb_2.5.3-1.dsc
> 2a1de0a6093dc942b69508d7d788f917c2d9a9ac 2273398
> php-mongodb_2.5.3.orig.tar.gz
> c5dee36dd821003ecaf1fa277dcfa17cf6299a61 8056
> php-mongodb_2.5.3-1.debian.tar.xz
> bbebd247ab79d1867fec7fcde704d081b2c9ab49 7868
> php-mongodb_2.5.3-1_amd64.buildinfo
> Checksums-Sha256:
> c0992c9e3ce0e8b77e1c90584ab4433214e7cc9b6b8d74274192c9c84eab6156 2374
> php-mongodb_2.5.3-1.dsc
> 5e5369cd01b47543fb3244917eff17fa4c8c357b0866828d59c899b4e53e6665 2273398
> php-mongodb_2.5.3.orig.tar.gz
> ff95d738af09e32f701563228159b226e28868b39366a7d4ce255b2366497508 8056
> php-mongodb_2.5.3-1.debian.tar.xz
> b7ccf021c17dfb19c2b02f54b7a9eff3ac6c496d70b6fabfe2cb05779893f233 7868
> php-mongodb_2.5.3-1_amd64.buildinfo
> Files:
> a7fcfaeea1462ed58a6055185778bc4f 2374 php optional php-mongodb_2.5.3-1.dsc
> a084b1e96c0105bed9b72385586c67e8 2273398 php optional
> php-mongodb_2.5.3.orig.tar.gz
> 2f285619becfbea5a48a747915bac277 8056 php optional
> php-mongodb_2.5.3-1.debian.tar.xz
> f79ef4edca5fe57d9149129e87ca8754 7868 php optional
> php-mongodb_2.5.3-1_amd64.buildinfo
>
> -----BEGIN PGP SIGNATURE-----
>
> iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmq99hpfFIAAAAAALgAo
> aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
> NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
> WcLTFhAAm7AU121Z1rQ3g/uYwdDqWs2Fjnn85TPrkkWl1Rlrrcv3DLhAOtE3eK8+
> hIVAn7xfUnqx21YbkqiWKQlGCm0sygxaoR4qCQzw3WqmDXIYq3GOlHqlErVdjUif
> C6AJJqjCJZ2ETNqhdJ7bTgImjJBQ4fLOND5M/6MJVvWgeReIZok6lLbIQ7np8pCF
> YvRyN2dkyEIwmENex1WTEd7cXyiwibBnX+UqSpeH/24WjOPiBH4GQuWIRIkdLuKM
> dt763ZeYFa4Z2DPR3+kYTUh9YqNoy4aEYIRpRYX8L3XIZC/jph6fbT5Lg1PubR9r
> rJKIZLaQksPy+VM8L6zk00wpEPPIo9ehCgz2/IW0jpWGSAkB2CrYrb+lMRuIXpOO
> uAjD2vkRNJWKhE2dtKth/BWfOH+puD7Hz7Kd10sm96tmhkqu/cWKmn68rx8+Imir
> 3TczoccoOKh3lKHVo/CvuysYM1O6R3evD6VT5ZMxAtRCqil3nVPcf7lNgFjUBFWB
> 0RJaPP7SNr1Otd2EVUe1xwjlYWW4/ey5YOzy8zeEVpD/ILQs0sPsVpn2lnfN01rS
> SGypH4FCoLpXTm9PagPNxAMuO2teRGdDir4J+2e7+KDXpq15VNk1WzNb/wIWa6w2
> k2QKxSVvh1QKje5rrCEUwZd4eJa7Qp77m+iwK1bXh9ImAaTkOkM=
> =y+jw
> -----END PGP SIGNATURE-----
--- End Message ---
