Hi Roberto, Thank you for confirming the issue and for working on the fix.
When you get a chance, could you share a rough timeline for when the updated package (1.30.4-1+deb13u4) might be available? Regards, Jeevan On Thu, Oct 8, 2026 at 11:23 PM Roberto C. Sánchez <[email protected]> wrote: > On Thu, Oct 08, 2026 at 04:21:01PM +0530, Jeevan Chalke wrote: > > Package: src:mongo-c-driver > > Version: 1.30.4-1+deb13u3 > > Severity: grave > > Tags: security patch > > X-Debbugs-Cc: [1][email protected] > > > > Dear Maintainer, > > > > debian/patches/0009_CVE-2026-81524.patch (the backport of upstream > > CDRIVER-6424, "validate db and collection names") breaks > > mongoc_collection_aggregate() for every collection. It always > returns a > > cursor in the error state: > > > > database name "<db>.<collection>" invalid: contains "." > > > Argh! I'm really sorry for the mistake in the patch. Thank you for > reporting this (especially for the thoroughness of your report). I will > upload a fix for this as soon as I can. > > Regards, > > -Roberto > > -- > Roberto C. Sánchez > http://people.connexer.com/~roberto > http://www.connexer.com > -- *Jeevan Chalke* *Senior Principal Engineer, Engineering Manager* *Product Development* enterprisedb.com <https://www.enterprisedb.com>
