Your message dated Thu, 22 Oct 2026 06:19:13 +0000
with message-id <[email protected]>
and subject line Bug#1150462: fixed in pymongo 4.19.0-1
has caused the Debian Bug report #1150462,
regarding pymongo: CVE-2026-106435
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150462: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150462
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: pymongo
Version: 4.18.2-1
Severity: important
Tags: security upstream
Forwarded: https://jira.mongodb.org/browse/PYTHON-6110
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for pymongo.
CVE-2026-106435[0]:
| The MongoDB Python Driver's binary accelerator can read outside a
| buffer when an application decodes malformed BSON containing a
| truncated regular-expression element without a trailing NUL byte. An
| actor who can supply BSON to the documented decode or decode_all API
| can cause the application process to terminate when the C extension
| is loaded. The driver's normal database wire-protocol path does not
| reach this code.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-106435
https://www.cve.org/CVERecord?id=CVE-2026-106435
[1] https://jira.mongodb.org/browse/PYTHON-6110
[2]
ttps://github.com/mongodb/mongo-python-driver/commit/bb8d4e195275e75bd94ebeffb53cc747d357fcf4
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: pymongo
Source-Version: 4.19.0-1
Done: Aryan Karamtoth <[email protected]>
We believe that the bug you reported is fixed in the latest version of
pymongo, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Aryan Karamtoth <[email protected]> (supplier of updated pymongo
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 22 Oct 2026 10:37:29 +0530
Source: pymongo
Architecture: source
Version: 4.19.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <[email protected]>
Changed-By: Aryan Karamtoth <[email protected]>
Closes: 1150462 1150621
Changes:
pymongo (4.19.0-1) unstable; urgency=medium
.
[Federico Molara]
* New upstream bug fix release.
- Bound C BSON regular-expression scans to the remaining document bytes
(CVE-2026-106435). (Closes: #1150462)
.
* Adopt the package within the Debian Python Team; add myself to Uploaders
and retain Aryan Karamtoth. (Closes: #1150621)
.
[Aryan Karamtoth]
* New upstream release 4.19.0
Checksums-Sha1:
4747e443b7457d46648167bf3ef46ff29a4fd516 2604 pymongo_4.19.0-1.dsc
fcf32911e6c85720b7b03d9089d8b5ab34543284 2764823 pymongo_4.19.0.orig.tar.gz
afd50d6c14d473f0bb41e746e37ac4e90aeb492f 7680 pymongo_4.19.0-1.debian.tar.xz
f58c22b6d9ec6b29ec938f76676ed92841d7b7b7 9972 pymongo_4.19.0-1_amd64.buildinfo
Checksums-Sha256:
bcf516e9fa097bab845144b59b3515876fdc10730bd8793505605ca332a5d296 2604
pymongo_4.19.0-1.dsc
a0fef4bd7074a4339b31473867ce117f9156b9485c16ca7df9a0ff919306c9b3 2764823
pymongo_4.19.0.orig.tar.gz
76a9bd13e9f04bbb666847140e5e267e820af790fc6c640b290968a47944f89d 7680
pymongo_4.19.0-1.debian.tar.xz
4df9763407222efd44881b0a4bf4e0c9186b348e107ca5de4db20af7b22f42f3 9972
pymongo_4.19.0-1_amd64.buildinfo
Files:
28b7938b92dc28578e685b4b0a908421 2604 python optional pymongo_4.19.0-1.dsc
05e0611f12e69189558f0b8e6dfebb09 2764823 python optional
pymongo_4.19.0.orig.tar.gz
94df4b809bc8177abe2db6348f4ebe1f 7680 python optional
pymongo_4.19.0-1.debian.tar.xz
cc29e21cc9c33fd3efdf5aa441622086 9972 python optional
pymongo_4.19.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEen2TCCvRm6+oO340/pAHuO1kBCEFAmrZpyMACgkQ/pAHuO1k
BCHxag//bIjWkr0rYghmD/SDIkAcvP2NT/dj2qcMoCy46VZSwu03qlrJIACx3JgI
mdRmMC8PeheiXasHsIc3CBSyZzALrIotdw9KWD048r57I/tdmxDxS8o1hFN5r5qR
lzEP4Q8wC7JzrO4XctoQ7h8a6ECAlXyH1K9FP6aTmJnjsYoo2075J55f88HD0gPo
xu+C2vvqtXbl1XUMoFXauxfsbjj6w6QCDn2hUXKgCsccisX35jM+ZhhsgXkn12FC
7acjN8VqHe3MJrHCH2G9EDhU0OlviQp+EA2gicnKGq6MyvGnJx/IOTxqguI9kHjj
pP6QiekKgHmRjLjLc9v5TcxsT7GbDHTqifPMVLUupQHzOhJQ05G2GSu24W+dC75t
51upriiMIdBAy8szTaFUUGdYCzHGChfo3Jx3+GK69/uLiGZMe9oRKDAHOKxJFdsH
g3jh7CXf6elm6ybFbXYeaxnoJyEi1uf5tdQBX7c7VAIEq+6l6Lzxuxqthjr6XCI+
6nhdoDF3BSeen8VU2Toa2I+hRqkP3Rve8vIy/vy9QVj0+IcLwsy9oNvnfAKLYveX
uPptU+6Rf6ztXafIOksAdBLkbmY4rQt7HzJ/xxcpTeGwcoh9pIBmALEyNkIl+JaL
u9n1803dgX7EK243oVqouRvuSNbHbateoaVe7pDweFul61RwByQ=
=yyZE
-----END PGP SIGNATURE-----
pgpe6XTb0mQQZ.pgp
Description: PGP signature
--- End Message ---
