Hi Ondrej, On Fri, Sep 25, 2026 at 09:19:06PM +0200, Ondřej Surý wrote: > Salvatore, would it be feasible to pick the new upstream version or do you > want me to cherry-pick the patches for the CVEs? The deb.sury.org > <http://deb.sury.org/> does > have 2.5.2 since Wednesday and no regression reports were reported.
I think that was only fixed in 2.5.3 upstream for the given CVE. There are currently 3 known open issues according to https://security-tracker.debian.org/tracker/source-package/php-mongodb but we have not yet evaluated in our backlog if they warrant a DSA. Let's followup on [email protected] with that. Regards, Salvatore
