-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Nov 2026 16:12:33 -0500
Source: mongo-c-driver
Binary: libbson-1.0-0t64 libbson-1.0-0t64-dbgsym libbson-dev libmongoc-1.0-0t64 libmongoc-1.0-0t64-dbgsym libmongoc-dev
Architecture: arm64
Version: 1.30.4-1+deb13u5
Distribution: trixie
Urgency: medium
Maintainer: arm64 Build Daemon (arm-ubc-02) <buildd_arm64-arm-ubc-02@buildd.debian.org>
Changed-By: Roberto C. Sanchez <roberto@connexer.com>
Description:
 libbson-1.0-0t64 - Library to parse and generate BSON documents - runtime files
 libbson-dev - Library to parse and generate BSON documents - dev files
 libmongoc-1.0-0t64 - MongoDB C client library - runtime files
 libmongoc-dev - MongoDB C client library - dev files
Changes:
 mongo-c-driver (1.30.4-1+deb13u5) trixie; urgency=medium
 .
   * Fix CVE-2026-84965: heap write primitive via size round-up wrap during JSON
     parsing on 32-bit builds
   * Fix CVE-2026-84963: silent field truncation via unchecked int cast of huge
     JSON string values in JSON-to-BSON parser
   * Fix CVE-2026-84964: heap corruption via OCSP request double free from
     crafted multi-URL certificate in TLS client
   * Fix CVE-2026-84969: heap overflow via truncated base64 encoding of binary
     fields in length-limited JSON output
   * Fix CVE-2026-88035: heap buffer overflow via wrapped size check during SASL
     username canonicalization
   * Fix CVE-2026-88036: GridFS data disclosure and deletion via query-operator
     injection in file IDs
   * Fix CVE-2026-93394: SCRAM nonce validation bypass
   * Fix CVE-2026-96746: heap buffer overflow via mid-scan command list growth
     in client topology monitoring
   * Fix CVE-2026-106428: out-of-bounds read in SCRAM authentication response
     parsing
   * Fix CVE-2026-106431: one-byte heap buffer overflow in BSON bulk document
     writer
   * Fix CVE-2026-106438: silent Decimal128 value corruption via incorrect
     exactness check
   * Fix CVE-2026-106437: out-of-bounds read and write via undersized BSON
     buffer reservation
   * Fix CVE-2026-120955: application abort on malformed GridFS metadata
   * Fix CVE-2026-120678: leaks the decompressed reply buffer when an
     OP_COMPRESSED reply fails to parse (denial of service)
   * Fix CVE-2026-120684: GridFS gap lets a shared writer recover a protected
     client's password
   * Fix CDRIVER-6401: abort in cursor namespace parsing when no dot separator
     (required by CVE-2026-120956 fix)
   * Fix CVE-2026-120956: remote abort and memory disclosure from a malformed
     cursor.ns
   * Fix CDRIVER-6523: mandate raising writeConcernError (change SHOULD to MUST)
     + this fixes a potential loss of data by ensuring that a WCE reported by
       the server is propagated rather than discarded
Checksums-Sha1:
 244ce124abcf3ff55ff8d07a8624857dd1a9c7c9 315508 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_arm64.deb
 2c631edbb1dc3d094178b7293756247eaad9c516 86648 libbson-1.0-0t64_1.30.4-1+deb13u5_arm64.deb
 e54cacb4b57027f37b84a4a61aed6d97120d9fef 152208 libbson-dev_1.30.4-1+deb13u5_arm64.deb
 6a832952625fbdb305b2ba6319079ebb6b123203 1646328 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_arm64.deb
 0a9ad856e33c1164a9cff56f7881155df0e1b115 365932 libmongoc-1.0-0t64_1.30.4-1+deb13u5_arm64.deb
 c129990010b2358ff57d9d5c452c67c646132bd2 474388 libmongoc-dev_1.30.4-1+deb13u5_arm64.deb
 5fe7ab8f75a3b8f469c1e353f2f972e8c77a89f8 10511 mongo-c-driver_1.30.4-1+deb13u5_arm64-buildd.buildinfo
Checksums-Sha256:
 ce96ee682548f4d6c51857efcae94c1100ac29abb18dd71a7c7a05eb4381abba 315508 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_arm64.deb
 e85fd01bc9dd88d1cd6fa55c1bf80c9c90794e7efe0c3a76408321fe0ad6e9a0 86648 libbson-1.0-0t64_1.30.4-1+deb13u5_arm64.deb
 6d0d4c9960a6ee5b67ca7e992be9df60721dc9a95b5b31b1781c9d2da5734727 152208 libbson-dev_1.30.4-1+deb13u5_arm64.deb
 f74cfb2ec4c643b6553d4f544c8de38c6b0275e4ab7893f1b2571f7cc558f005 1646328 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_arm64.deb
 0cddeca63c5464aaf08218b7513e9caed5dcb900bdfb48222ac2c9017811c8b3 365932 libmongoc-1.0-0t64_1.30.4-1+deb13u5_arm64.deb
 d1cd3439a6059873bb2f382acc5a2b6e5b98f22fb555608cca3b262d25a9d7d7 474388 libmongoc-dev_1.30.4-1+deb13u5_arm64.deb
 3359914c2dfeecbb96ffba5276b7f2c8ec32026aa2a9211e04721fd344afc0ee 10511 mongo-c-driver_1.30.4-1+deb13u5_arm64-buildd.buildinfo
Files:
 a5d104a530563957d6a38a19d950a256 315508 debug optional libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_arm64.deb
 b18e820cc9c5dc985278f3a276354014 86648 libs optional libbson-1.0-0t64_1.30.4-1+deb13u5_arm64.deb
 f67ac435cfe9008cc73e26dd926b6ae4 152208 libdevel optional libbson-dev_1.30.4-1+deb13u5_arm64.deb
 c81aeb5e139db08ee5b13e771e11ce28 1646328 debug optional libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_arm64.deb
 7cf96bb90ad6884bf2f45a86ccb6331d 365932 libs optional libmongoc-1.0-0t64_1.30.4-1+deb13u5_arm64.deb
 fa36a8a7b262dac3c99456a89e8390e5 474388 libdevel optional libmongoc-dev_1.30.4-1+deb13u5_arm64.deb
 e2479326454532bb1a4d4b39dda4ed7e 10511 libs optional mongo-c-driver_1.30.4-1+deb13u5_arm64-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEJkN0BnKzGWWW6tS+G5VHrWJmwgcFAmr45/8ACgkQG5VHrWJm
wgc1fw/+P54lJYG+A4x/edIPdQdVtd9c0RTHh35F3CXuavBxijnd3ZvvYrcCC4xu
pFZWTHg4vzDffZSWZrn+Nz3e0/ELgL3HrveQ8oYkIckVm9cKrDyy/BHP9K+Ehp0g
/6h+4pLzy564FHnBLtV32VHgqcNHYwDMig1Kd55mgA1cZfN9fEexs+4M0Qfa3q9P
CxMhffASpfQ8j0R+e+qV2O6pITdVjwAKBFxQ3J1rMg1/HRbhUEFriJG0NPhkV/B+
6QPa16+0zJu4YRvXw73PpGd8cJZjARIessvqrEP9n5pEj3iMbhfGZWOCRdBLcopB
7/CjRbrGkGhqdXbRkP+H9xb9KBeaW+uvmysCAIi/2SGusStfWkDbLbKamZ5/Emlb
ZAa2PTd5XcvfsVvlra7RSzuh8rPzqPypCCI2wXRo/WvlGgR4f2yD23Lk/2PJQk2W
mZmWLehAqEzHB1KB3WlXVAlz2zbRsnHy+Nf66w9ThE8wn6IXf92jXzy66QC0H8sm
DrrpcdpyaGGGenHbxM07tNlOEhUxwsK68i8vKYyu9Pnejbf2NTV8Lln2yI57vP6x
tj1ffpl6jYKoh7VNGC7kvHiwf++331A1BAIU87HL0vEMB2H8MMnXtrdTrPlSF6Nm
HaWMfLCK2rVlBtF5agBenr2W/ATP9Uu9tnWmT3whHKkp731i4Qk=
=JqI6
-----END PGP SIGNATURE-----