-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Nov 2026 16:12:33 -0500
Source: mongo-c-driver
Binary: libbson-1.0-0t64 libbson-1.0-0t64-dbgsym libbson-dev libmongoc-1.0-0t64 libmongoc-1.0-0t64-dbgsym libmongoc-dev
Architecture: i386
Version: 1.30.4-1+deb13u5
Distribution: trixie
Urgency: medium
Maintainer: i386 Build Daemon (x86-grnet-01) <buildd_amd64-x86-grnet-01@buildd.debian.org>
Changed-By: Roberto C. Sanchez <roberto@connexer.com>
Description:
 libbson-1.0-0t64 - Library to parse and generate BSON documents - runtime files
 libbson-dev - Library to parse and generate BSON documents - dev files
 libmongoc-1.0-0t64 - MongoDB C client library - runtime files
 libmongoc-dev - MongoDB C client library - dev files
Changes:
 mongo-c-driver (1.30.4-1+deb13u5) trixie; urgency=medium
 .
   * Fix CVE-2026-84965: heap write primitive via size round-up wrap during JSON
     parsing on 32-bit builds
   * Fix CVE-2026-84963: silent field truncation via unchecked int cast of huge
     JSON string values in JSON-to-BSON parser
   * Fix CVE-2026-84964: heap corruption via OCSP request double free from
     crafted multi-URL certificate in TLS client
   * Fix CVE-2026-84969: heap overflow via truncated base64 encoding of binary
     fields in length-limited JSON output
   * Fix CVE-2026-88035: heap buffer overflow via wrapped size check during SASL
     username canonicalization
   * Fix CVE-2026-88036: GridFS data disclosure and deletion via query-operator
     injection in file IDs
   * Fix CVE-2026-93394: SCRAM nonce validation bypass
   * Fix CVE-2026-96746: heap buffer overflow via mid-scan command list growth
     in client topology monitoring
   * Fix CVE-2026-106428: out-of-bounds read in SCRAM authentication response
     parsing
   * Fix CVE-2026-106431: one-byte heap buffer overflow in BSON bulk document
     writer
   * Fix CVE-2026-106438: silent Decimal128 value corruption via incorrect
     exactness check
   * Fix CVE-2026-106437: out-of-bounds read and write via undersized BSON
     buffer reservation
   * Fix CVE-2026-120955: application abort on malformed GridFS metadata
   * Fix CVE-2026-120678: leaks the decompressed reply buffer when an
     OP_COMPRESSED reply fails to parse (denial of service)
   * Fix CVE-2026-120684: GridFS gap lets a shared writer recover a protected
     client's password
   * Fix CDRIVER-6401: abort in cursor namespace parsing when no dot separator
     (required by CVE-2026-120956 fix)
   * Fix CVE-2026-120956: remote abort and memory disclosure from a malformed
     cursor.ns
   * Fix CDRIVER-6523: mandate raising writeConcernError (change SHOULD to MUST)
     + this fixes a potential loss of data by ensuring that a WCE reported by
       the server is propagated rather than discarded
Checksums-Sha1:
 9f9268fdf8fe186552b63994e06d275dec01756c 278988 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_i386.deb
 fd5a71386bca2ff5a6e318b017b181913b7d7ce5 98164 libbson-1.0-0t64_1.30.4-1+deb13u5_i386.deb
 d2a1fa77b5287b47f5c8a5ea78ead3a47b9037bb 162844 libbson-dev_1.30.4-1+deb13u5_i386.deb
 60a54e6a9116479d5445169de04a191405a6b02c 1429224 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_i386.deb
 205961a0ed8d3fc8581784161e37a01d87be5609 422932 libmongoc-1.0-0t64_1.30.4-1+deb13u5_i386.deb
 eb2710e0582413ea9f7a8357b21793fb0565c433 513660 libmongoc-dev_1.30.4-1+deb13u5_i386.deb
 6105cd5bbe1d9a176a1c892a859e3adae5135880 10416 mongo-c-driver_1.30.4-1+deb13u5_i386-buildd.buildinfo
Checksums-Sha256:
 d7f1d826b01d216fb554951fb76e42e7f9e4a67d303df7a6116c5f3c080b5e6d 278988 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_i386.deb
 8a953579cbf304e8cdcf3508297802cbcda9169b11e34fa9020670e19abc7abd 98164 libbson-1.0-0t64_1.30.4-1+deb13u5_i386.deb
 e16f9e23232e03224075d1f0067107faf1837e05372ad66cbb49e29c3ec015da 162844 libbson-dev_1.30.4-1+deb13u5_i386.deb
 ba59d0b6863d7e7d766d50cd9430cbe0effcd5f88a5526ffb9ff54dcdc65ae7f 1429224 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_i386.deb
 819a6dfcfb7228f0694eb75a5b66ee171d662bcf1d4b2f538db5acfc9b276670 422932 libmongoc-1.0-0t64_1.30.4-1+deb13u5_i386.deb
 516952ca22ce8378bd920c5c5588819a9e17adc46db28902f26673b432c11577 513660 libmongoc-dev_1.30.4-1+deb13u5_i386.deb
 e3356e689d0d05388cf0a20b99740fe5a79d205436b22fd70debb6241bf0bc8e 10416 mongo-c-driver_1.30.4-1+deb13u5_i386-buildd.buildinfo
Files:
 37419d2c9b893e89fe7769397f8b9afd 278988 debug optional libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_i386.deb
 8e5b8c3608321c3ee9388320392ebbf8 98164 libs optional libbson-1.0-0t64_1.30.4-1+deb13u5_i386.deb
 7d89869ee179474fc24f31a99db7d88b 162844 libdevel optional libbson-dev_1.30.4-1+deb13u5_i386.deb
 b6f901c1d436f96d22eaa28de99804e1 1429224 debug optional libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_i386.deb
 194fc0c977ce155f7da77b1f998cca5d 422932 libs optional libmongoc-1.0-0t64_1.30.4-1+deb13u5_i386.deb
 0f8efb165710de29f681e519139d6175 513660 libdevel optional libmongoc-dev_1.30.4-1+deb13u5_i386.deb
 9b3c793d55dfe9022a511ee6b7e33fcb 10416 libs optional mongo-c-driver_1.30.4-1+deb13u5_i386-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEPAUaMA0H0rOy6qBWf2INRiCdaWIFAmr46DwACgkQf2INRiCd
aWIlSxAAoJfnJBAQusA+UtiaDYCR0iJPmBbFflzz6c6Zg28/SZ8kcNE3uTWuhPpE
8fLLdaoGUwWiI03gJYEGitMfJQY2WU5onk46C0TVliu/y/klfAlXDnn6GRcnm4pH
JGPSSnMKeJin+b5jwhdl1WpuhhW6wTivMRO9iNFLrcWuThcKHvAABAu69yU1zyKK
JK4o+GYU/l8auQ/2Z4q94lY967Scn31kNMn9sVCHsU3Kds650nPQXBpUvnc3rHmY
HMDalF4W/SQfp6xoPDznOZ38icZn5CNi2+/GiZZBRC5iOh6YZYIaX6db6UvuRPmz
HUY92u3gJyiK5vSJ50cPmpH+LvSAzYn1oPs58N9eiuLVAxw5W5JhOZiEEUJj9qy/
9paB30HgS71f64wxCZddfDcD+czC2Cor94cEGxsBYzJ/TPEuX424xikmfAlEO1UH
RKXNLi69/JhbG2sSBqwbhHZku0nBP+dyMlANC+MLk7etG/DOnq5jdVYlDxYzcARF
6yNPAK9HYthFb7oJFtjMqoyeWnf9u4eKm2PW3q9RSN7DtN89sa30FX0VbZPqQHEV
9383vJ+WrkejH+lwkNHI+odb4jq4NJ3rd3CLc8R1CAAcmGH3BKC2LtPQv7hlcOcf
HfD9WY5zgEZJCCOS5iBtm/6LM75aX7vEgtDtQNdeFJTN/CQq33o=
=bpGH
-----END PGP SIGNATURE-----