Salvatore, would it be feasible to pick the new upstream version or do you want me to cherry-pick the patches for the CVEs? The deb.sury.org <http://deb.sury.org/> does have 2.5.2 since Wednesday and no regression reports were reported.
Ondrej -- Ondřej Surý (He/Him) [email protected] A gentle nudge is always appreciated if I take a little longer to reply. > On 25. 9. 2026, at 21:11, Salvatore Bonaccorso <[email protected]> wrote: > > Source: php-mongodb > Version: 2.1.0-1 > Severity: important > Tags: security upstream > Forwarded: https://jira.mongodb.org/browse/PHPC-2743 > X-Debbugs-Cc: [email protected], Debian Security Team > <[email protected]> > > Hi, > > The following vulnerability was published for php-mongodb. > > CVE-2026-96745[0]: > | Deserialization of untrusted data in the command monitoring support > | of the MongoDB PHP Driver can cause class names embedded in document > | content to be honored when the driver builds monitoring event > | objects. When an application registers a command monitoring > | subscriber and includes untrusted data in a database operation, an > | unauthenticated party who controls that data may cause an > | application class implementing the driver's persistable interface to > | be instantiated and its unserialization method invoked with the > | supplied data. The resulting impact depends on the classes available > | in the application. > > > If you fix the vulnerability please also make sure to include the > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > For further information see: > > [0] https://security-tracker.debian.org/tracker/CVE-2026-96745 > https://www.cve.org/CVERecord?id=CVE-2026-96745 > [1] > https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c > [2] https://jira.mongodb.org/browse/PHPC-2743 > [3] https://github.com/mongodb/mongo-php-driver/pull/2115 > > Please adjust the affected versions in the BTS as needed. > > Regards, > Salvatore
