-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 01 Oct 2026 08:25:18 +0200 Source: php-mongodb Architecture: source Version: 2.0.0-1+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian PHP PECL Maintainers <[email protected]> Changed-By: Ondřej Surý <[email protected]> Changes: php-mongodb (2.0.0-1+deb13u1) trixie-security; urgency=high . * PHPC-2744: Fix out-of-bounds read of field path + [CVE-2026-84968]: An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents. * PHPC-2743: Fix __pclass inference in events + [CVE-2026-96745]: Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. * PHPC-2636: Respect libbson nesting limit when parsing PHP objects + [CVE-2026-6811]: Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server. Checksums-Sha1: dd57e74f4da3c5d4e7087f3d1e3499e816424da7 2408 php-mongodb_2.0.0-1+deb13u1.dsc b7960c0671e928a07c8d60b4b4a3cb0823617239 2109177 php-mongodb_2.0.0.orig.tar.gz e8b54471bce5212ad75951d7ec44f0b5849d090f 14764 php-mongodb_2.0.0-1+deb13u1.debian.tar.xz 0a13d26fe25c401b2335f0db3bfc98b5ef26eacf 8555 php-mongodb_2.0.0-1+deb13u1_amd64.buildinfo Checksums-Sha256: 24279015de663838340e40c3584e89625289fb187ad402ceda9055b165410de9 2408 php-mongodb_2.0.0-1+deb13u1.dsc 6a53987a5e75fc65d032ac93cc8d4522a5cd06e068828e6b6e12612597fc88df 2109177 php-mongodb_2.0.0.orig.tar.gz 2aa0ae4b0d75fd2bded5e4ca9aca8b76a54a4cc8c6bd20516fa51b2278b44c76 14764 php-mongodb_2.0.0-1+deb13u1.debian.tar.xz cba24fe1488e53c26a827b78d8d79337ff726f896f6df30d722ae9211f9c16cb 8555 php-mongodb_2.0.0-1+deb13u1_amd64.buildinfo Files: 224a0343758028163322c9c88168ea6b 2408 php optional php-mongodb_2.0.0-1+deb13u1.dsc 792a1acdc4e247cf5c8dad0f3b12b931 2109177 php optional php-mongodb_2.0.0.orig.tar.gz 874e923bb400cc43090d0c916f3026c1 14764 php optional php-mongodb_2.0.0-1+deb13u1.debian.tar.xz 0b2f928bb0a1d364db84f150d20be92d 8555 php optional php-mongodb_2.0.0-1+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmq+AYFfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u WcKOCg//Q0pX0Z85zmQyj/vkj6vmOE0Y0TP+HjsMWI0QBZr63ATK+lIloE2fJTev osVENDgDmtvJdVUFsMHOLjoasHz6DIRrwenkoX0uStZPsLxUeDAzcZmzvpN1gL/L tPWbkjKuLNgw05T+Jcw5mwjFBGpan4z+qakcl1pcblzy76fhYfiZ7rs+kJkD0dgH 2jj0JZtEGnEdX4GDJigZIe5ac65KuZ0QMOdM8CRCoCzWsOWhXVygJj8dYPZAAP4F oWXVh2F6UXEGFTlCQNiQZoqZTJ1J4dQeeqN+aKzTsBQk9KQjFwZ3uB5rq0BSJzHf IXLAV4BZPlE6VjS4D8yxh1Xp+sCIrxvbl4YXAp2sFOipmIUwLZSy9pFGqKzUQZfy I1ZJIPrcFT/98omq18XK42H6Yd4GvsfGldJ5cdKhWCu9HyzZNlzl25YWCgrJAx6z lAqpu+vxm/euAVLm2h4iQpbl7rlaX8nxxWj4hbSIsnvXkcknUOgLNhfezhrudVTU X9V50lGmg/yGTaTSwqVyys1dGPN0Ha2naT+o+WX839jC3ewcZvsjMvHlNbcNVzCA XhSrAREa0o81gw/Ct4r6EQu0F/D5UKMMjULi3XscAlecs2wP2QAIzLIIhsnwREtd 0UN0HGfxmZ3nNjOkUjYyMaLii5mxj/3hvbApHI4X4OXtWjkMAM8= =9keu -----END PGP SIGNATURE-----
pgpHqBhu5vulV.pgp
Description: PGP signature
