Your message dated Wed, 28 Oct 2026 07:36:42 +0100
with message-id <[email protected]>
and subject line Re: Accepted php-mongodb 2.5.5-1 (source) into unstable
has caused the Debian Bug report #1150514,
regarding php-mongodb: CVE-2026-106432 CVE-2026-106436
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150514: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150514
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: php-mongodb
Version: 2.5.3-1
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerabilities were published for php-mongodb.
CVE-2026-106432[0]:
| The BSON encoder in the MongoDB PHP Driver converts a string length
| to a 32-bit value without validation. When an affected application
| encodes a string near 4 GiB, the allocation size can wrap while the
| copy operation uses the original length. The resulting heap buffer
| overflow can corrupt process memory or terminate the PHP process.
| Reaching this issue requires a non-default runtime configuration
| that permits multi-gigabyte values. No MongoDB server interaction is
| required.
CVE-2026-106436[1]:
| The BSON encoder in the MongoDB PHP Driver does not check some
| return values after a document exceeds libbson's size limit. This
| can leave the encoder in an invalid state. An unauthenticated actor
| who can cause an affected application to encode an unusually large
| data structure can terminate the PHP worker or cause the resulting
| document to omit fields. No MongoDB server connection or database
| authentication is required.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-106432
https://www.cve.org/CVERecord?id=CVE-2026-106432
https://jira.mongodb.org/browse/PHPC-2741
[1] https://security-tracker.debian.org/tracker/CVE-2026-106436
https://www.cve.org/CVERecord?id=CVE-2026-106436
https://jira.mongodb.org/browse/PHPC-2739
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: php-mongodb
Source-Version: 2.5.5-1
On Wed, Oct 28, 2026 at 05:34:31AM +0000, Debian FTP Masters wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Format: 1.8
> Date: Sun, 25 Oct 2026 19:12:11 +0100
> Source: php-mongodb
> Architecture: source
> Version: 2.5.5-1
> Distribution: unstable
> Urgency: high
> Maintainer: Debian PHP PECL Maintainers <[email protected]>
> Changed-By: Ondřej Surý <[email protected]>
> Changes:
> php-mongodb (2.5.5-1) unstable; urgency=high
> .
> * New upstream version 2.5.5
> + [CVE-2026-106432]: Bound-check string and binary lengths in BSON
> encoder to prevent 32-bit narrowing
> + [CVE-2026-106436]: Encoder ignores libbson append return values,
> aborting on oversized documents
> + [CVE-2026-112368]: Recursive bsonSerialize() output may segfault
> Checksums-Sha1:
> 4bf0f5dfcae0c0314be7e9206eed3e0684f1f0a9 2374 php-mongodb_2.5.5-1.dsc
> fb6d1445da9511ddce28e114cc2b745f9a071ef5 2277212
> php-mongodb_2.5.5.orig.tar.gz
> 0b61d1b7e87a4ad85acb2fcc10884ce7b59c81ba 8192
> php-mongodb_2.5.5-1.debian.tar.xz
> 5bdcc1288656743e8761611cd2d1fcd73f235fe3 7982
> php-mongodb_2.5.5-1_amd64.buildinfo
> Checksums-Sha256:
> e1a6357e9cd231eab467babe62ea297194e7076c4d450daeb842760a83214ed8 2374
> php-mongodb_2.5.5-1.dsc
> 0eaf84ff709f73183d80597f31ff02937f6aefde01eb895a0aa19334a290cec0 2277212
> php-mongodb_2.5.5.orig.tar.gz
> 9bf2d0476aaaf0a5dfcf0d2eb89fb85baba48d2ac1c8b08af199a1a70128fccd 8192
> php-mongodb_2.5.5-1.debian.tar.xz
> 12d507e03403daeb01729205650c3fd5f1a3ddb3d3b9920fa6c179fa3a84b10d 7982
> php-mongodb_2.5.5-1_amd64.buildinfo
> Files:
> 58d7e18a420c5597ba30a1e1e9cede8b 2374 php optional php-mongodb_2.5.5-1.dsc
> 7fd1c98fb542dd99806da858467ed001 2277212 php optional
> php-mongodb_2.5.5.orig.tar.gz
> c96e1ec7d1f0a525689f4f94e65dbb95 8192 php optional
> php-mongodb_2.5.5-1.debian.tar.xz
> dca67d12c3598a4e85cfeff9be383b14 7982 php optional
> php-mongodb_2.5.5-1_amd64.buildinfo
>
> -----BEGIN PGP SIGNATURE-----
>
> iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmrhg9dfFIAAAAAALgAo
> aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
> NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
> WcJhrg//SUVmBH4BXtvoPK7Ss9gfr09A+eMLDdlaDyy+S0YbQIpjf6VGiWne9CSL
> NBSEUgdON55OAHBfGWv/wYzFbwyewSPx+fel04tt3/0YwkHndMyGqzOs4bRZO1+G
> UD5cs5n7YXVRskMvDrCnkK+1JYvjCUTzXWxRqYUQ7I9/Tb3gRThWAqc8iCJHgglW
> yK9K1S4wC54YpK91kxUJOQtYQ4ih0J59VRP7ATPc898r/Z0B83HSHXkSKj3U45a7
> /qyX20jV2TApj4KUemLw1sPUqawHhSNXDUdaq1vV843urbpaDmoaR8UelAKGUTuO
> uWghhvnEuPoPO05s0AnH7uYdmB8sVTb/7/yh8xhidazKa4ly7guLm6E0/kmm8V+4
> 3m95kd5Pf77riiRKgdaBU6baONdQTgiOyfP/7RxZFWobUuSr7oqZxzL9L1owa3iA
> Fye1icruhfixx/nhDkAVQRQnYEY0tEMa2CVTTOP//9jxxz0rDymcP2C+48FeZHVu
> /0bECX1Ya3ijq+m4BLW/q0Oq6hY0WdMuaHuagFWP8CQY4aFATOTzeq7siSye/TP9
> WnhGb+S3sjaLv75FnwZcQoFoR+rlYvHKmGLI/z5cS65PT5XQWift0OxM/t5hmOld
> J50npe20Ro98J6aupBtbivhWyJVVNea63auNCl6da8GgtDImFwA=
> =UNS1
> -----END PGP SIGNATURE-----
--- End Message ---
