Your message dated Wed, 28 Oct 2026 07:36:42 +0100
with message-id <[email protected]>
and subject line Re: Accepted php-mongodb 2.5.5-1 (source) into unstable
has caused the Debian Bug report #1151934,
regarding php-mongodb: CVE-2026-112368
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151934: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151934
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: php-mongodb
Version: 2.5.3-1
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Forwarded: https://jira.mongodb.org/browse/PHPC-276
Hi,
The following vulnerability was published for php-mongodb.
CVE-2026-112368[0]:
| An uncontrolled recursion weakness in the BSON decoding logic of the
| MongoDB PHP driver may allow an unauthenticated party who can supply
| crafted binary document data to the decoder to exhaust the process
| stack. This may cause the PHP process using the driver to terminate
| unexpectedly, resulting in a loss of availability for that process.
| The condition occurs below the PHP layer and cannot be intercepted
| by application-level error handling.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-112368
https://www.cve.org/CVERecord?id=CVE-2026-112368
[1] https://jira.mongodb.org/browse/PHPC-276
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: php-mongodb
Source-Version: 2.5.5-1
On Wed, Oct 28, 2026 at 05:34:31AM +0000, Debian FTP Masters wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Format: 1.8
> Date: Sun, 25 Oct 2026 19:12:11 +0100
> Source: php-mongodb
> Architecture: source
> Version: 2.5.5-1
> Distribution: unstable
> Urgency: high
> Maintainer: Debian PHP PECL Maintainers <[email protected]>
> Changed-By: Ondřej Surý <[email protected]>
> Changes:
> php-mongodb (2.5.5-1) unstable; urgency=high
> .
> * New upstream version 2.5.5
> + [CVE-2026-106432]: Bound-check string and binary lengths in BSON
> encoder to prevent 32-bit narrowing
> + [CVE-2026-106436]: Encoder ignores libbson append return values,
> aborting on oversized documents
> + [CVE-2026-112368]: Recursive bsonSerialize() output may segfault
> Checksums-Sha1:
> 4bf0f5dfcae0c0314be7e9206eed3e0684f1f0a9 2374 php-mongodb_2.5.5-1.dsc
> fb6d1445da9511ddce28e114cc2b745f9a071ef5 2277212
> php-mongodb_2.5.5.orig.tar.gz
> 0b61d1b7e87a4ad85acb2fcc10884ce7b59c81ba 8192
> php-mongodb_2.5.5-1.debian.tar.xz
> 5bdcc1288656743e8761611cd2d1fcd73f235fe3 7982
> php-mongodb_2.5.5-1_amd64.buildinfo
> Checksums-Sha256:
> e1a6357e9cd231eab467babe62ea297194e7076c4d450daeb842760a83214ed8 2374
> php-mongodb_2.5.5-1.dsc
> 0eaf84ff709f73183d80597f31ff02937f6aefde01eb895a0aa19334a290cec0 2277212
> php-mongodb_2.5.5.orig.tar.gz
> 9bf2d0476aaaf0a5dfcf0d2eb89fb85baba48d2ac1c8b08af199a1a70128fccd 8192
> php-mongodb_2.5.5-1.debian.tar.xz
> 12d507e03403daeb01729205650c3fd5f1a3ddb3d3b9920fa6c179fa3a84b10d 7982
> php-mongodb_2.5.5-1_amd64.buildinfo
> Files:
> 58d7e18a420c5597ba30a1e1e9cede8b 2374 php optional php-mongodb_2.5.5-1.dsc
> 7fd1c98fb542dd99806da858467ed001 2277212 php optional
> php-mongodb_2.5.5.orig.tar.gz
> c96e1ec7d1f0a525689f4f94e65dbb95 8192 php optional
> php-mongodb_2.5.5-1.debian.tar.xz
> dca67d12c3598a4e85cfeff9be383b14 7982 php optional
> php-mongodb_2.5.5-1_amd64.buildinfo
>
> -----BEGIN PGP SIGNATURE-----
>
> iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmrhg9dfFIAAAAAALgAo
> aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
> NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
> WcJhrg//SUVmBH4BXtvoPK7Ss9gfr09A+eMLDdlaDyy+S0YbQIpjf6VGiWne9CSL
> NBSEUgdON55OAHBfGWv/wYzFbwyewSPx+fel04tt3/0YwkHndMyGqzOs4bRZO1+G
> UD5cs5n7YXVRskMvDrCnkK+1JYvjCUTzXWxRqYUQ7I9/Tb3gRThWAqc8iCJHgglW
> yK9K1S4wC54YpK91kxUJOQtYQ4ih0J59VRP7ATPc898r/Z0B83HSHXkSKj3U45a7
> /qyX20jV2TApj4KUemLw1sPUqawHhSNXDUdaq1vV843urbpaDmoaR8UelAKGUTuO
> uWghhvnEuPoPO05s0AnH7uYdmB8sVTb/7/yh8xhidazKa4ly7guLm6E0/kmm8V+4
> 3m95kd5Pf77riiRKgdaBU6baONdQTgiOyfP/7RxZFWobUuSr7oqZxzL9L1owa3iA
> Fye1icruhfixx/nhDkAVQRQnYEY0tEMa2CVTTOP//9jxxz0rDymcP2C+48FeZHVu
> /0bECX1Ya3ijq+m4BLW/q0Oq6hY0WdMuaHuagFWP8CQY4aFATOTzeq7siSye/TP9
> WnhGb+S3sjaLv75FnwZcQoFoR+rlYvHKmGLI/z5cS65PT5XQWift0OxM/t5hmOld
> J50npe20Ro98J6aupBtbivhWyJVVNea63auNCl6da8GgtDImFwA=
> =UNS1
> -----END PGP SIGNATURE-----
--- End Message ---
