Hi [Note I'm not speaking authoritatively here for SRM, I'm not member, but giving you some input]
On Tue, Nov 10, 2026 at 10:46:43PM +0100, Federico Molara wrote: > Dear Release Team, Salvatore and Python Team, > > A short follow-up to the trixie batch sent on 3 November: upstream has > merged PR #3195 (PYTHON-6252), fixing signed integer overflow when the > C BSON buffer doubles its capacity: > https://github.com/mongodb/mongo-python-driver/pull/3195 > > This complements the addition-size guard for CVE-2026-96749 already in > our batch. A source-level check shows that the old doubling code is > still present in Debian 4.19.0-2, trixie 4.10.1-6 and our candidate. > The small buffer.c hunk applies directly to the candidate; the PR also > contains upstream sanitizer CI additions. > > The submitted candidate is unchanged. Would you prefer to include this > complementary fix in the batch, once it is also fixed in unstable, or > handle it separately? The issue needs first to be fixed in unstable, so maybe fill a separate bug in the BTS to track it, fix it there. If by then the current proposed update for pymongo with the proposed changes is not yet uploaded to trixie-pu, then make a revision of 4.10.1-6+deb13u1 debdiff including that followup as well. If in meanwhile 4.10.1-6+deb13u1 was uploaded to trixie-pu (and hopefully included in the upcoming point release, but then that needs to happen latest this upcoming weekend), then make a new release.d.o bug for 4.10.1-6+deb13u2 including that followup (I'm sure until then there will be more CVEs to cover ;-)). Regards, Salvatore
