-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Nov 2026 16:12:33 -0500
Source: mongo-c-driver
Binary: libbson-1.0-0t64 libbson-1.0-0t64-dbgsym libbson-dev libmongoc-1.0-0t64 libmongoc-1.0-0t64-dbgsym libmongoc-dev
Architecture: riscv64
Version: 1.30.4-1+deb13u5
Distribution: trixie
Urgency: medium
Maintainer: riscv64 Build Daemon (rv-osuosl-04) <buildd_riscv64-rv-osuosl-04@buildd.debian.org>
Changed-By: Roberto C. Sanchez <roberto@connexer.com>
Description:
 libbson-1.0-0t64 - Library to parse and generate BSON documents - runtime files
 libbson-dev - Library to parse and generate BSON documents - dev files
 libmongoc-1.0-0t64 - MongoDB C client library - runtime files
 libmongoc-dev - MongoDB C client library - dev files
Changes:
 mongo-c-driver (1.30.4-1+deb13u5) trixie; urgency=medium
 .
   * Fix CVE-2026-84965: heap write primitive via size round-up wrap during JSON
     parsing on 32-bit builds
   * Fix CVE-2026-84963: silent field truncation via unchecked int cast of huge
     JSON string values in JSON-to-BSON parser
   * Fix CVE-2026-84964: heap corruption via OCSP request double free from
     crafted multi-URL certificate in TLS client
   * Fix CVE-2026-84969: heap overflow via truncated base64 encoding of binary
     fields in length-limited JSON output
   * Fix CVE-2026-88035: heap buffer overflow via wrapped size check during SASL
     username canonicalization
   * Fix CVE-2026-88036: GridFS data disclosure and deletion via query-operator
     injection in file IDs
   * Fix CVE-2026-93394: SCRAM nonce validation bypass
   * Fix CVE-2026-96746: heap buffer overflow via mid-scan command list growth
     in client topology monitoring
   * Fix CVE-2026-106428: out-of-bounds read in SCRAM authentication response
     parsing
   * Fix CVE-2026-106431: one-byte heap buffer overflow in BSON bulk document
     writer
   * Fix CVE-2026-106438: silent Decimal128 value corruption via incorrect
     exactness check
   * Fix CVE-2026-106437: out-of-bounds read and write via undersized BSON
     buffer reservation
   * Fix CVE-2026-120955: application abort on malformed GridFS metadata
   * Fix CVE-2026-120678: leaks the decompressed reply buffer when an
     OP_COMPRESSED reply fails to parse (denial of service)
   * Fix CVE-2026-120684: GridFS gap lets a shared writer recover a protected
     client's password
   * Fix CDRIVER-6401: abort in cursor namespace parsing when no dot separator
     (required by CVE-2026-120956 fix)
   * Fix CVE-2026-120956: remote abort and memory disclosure from a malformed
     cursor.ns
   * Fix CDRIVER-6523: mandate raising writeConcernError (change SHOULD to MUST)
     + this fixes a potential loss of data by ensuring that a WCE reported by
       the server is propagated rather than discarded
Checksums-Sha1:
 d41c670fd3d70ea3723786f0f8fb0ebb9f12f048 301008 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_riscv64.deb
 849686a401cc6c343ee66b8f8fbfc0b1ce355141 95544 libbson-1.0-0t64_1.30.4-1+deb13u5_riscv64.deb
 a5f59cd94f29fd54ec50747b8b68f15d3e8a82c9 316372 libbson-dev_1.30.4-1+deb13u5_riscv64.deb
 7e0c21e4f577958a3f54ddcccd3d82a8a73d3073 1610808 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_riscv64.deb
 dfa768b74cb9687ca8d962c5d3e8cdda0092e54b 405324 libmongoc-1.0-0t64_1.30.4-1+deb13u5_riscv64.deb
 f04ef60d6f94d9f644a21c9ccf1ba578677cf985 1050552 libmongoc-dev_1.30.4-1+deb13u5_riscv64.deb
 3bbcf267dd9810d23221e756de84b8ec0f7cb172 10498 mongo-c-driver_1.30.4-1+deb13u5_riscv64-buildd.buildinfo
Checksums-Sha256:
 dfcaaa545b53ee8bfada53e03c14ef85a0ec6111ce1596647e4d7548819f1b66 301008 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_riscv64.deb
 da6d650024bb1a4dafdbbf66106237d307e7092697103a2e8f26381c7dd94532 95544 libbson-1.0-0t64_1.30.4-1+deb13u5_riscv64.deb
 9c859da7ec13b6124947bf657e8123bf17e99be77c971f53cd9eb6cb542f6a81 316372 libbson-dev_1.30.4-1+deb13u5_riscv64.deb
 4082ace6fc73029339ea0a762c67f8a704a5fae228c0a651cf3f6f5596c56de1 1610808 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_riscv64.deb
 dc0a3b88a103b828a0e4f241bea4c407b4394bc6e436d14476ef436a42897f99 405324 libmongoc-1.0-0t64_1.30.4-1+deb13u5_riscv64.deb
 ab8535e8136a90cb939389154322f38c6a2d67addeee789a81cc1be92f0e3c1a 1050552 libmongoc-dev_1.30.4-1+deb13u5_riscv64.deb
 c1c6ceedfe0ea5403e369a89a588b9913064a1e2cbead68aaf5fd2aabea7240d 10498 mongo-c-driver_1.30.4-1+deb13u5_riscv64-buildd.buildinfo
Files:
 b67ed8b5ee354cc0259a1b9289d572cf 301008 debug optional libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_riscv64.deb
 5675db915f81b13429b6279faf4982cd 95544 libs optional libbson-1.0-0t64_1.30.4-1+deb13u5_riscv64.deb
 d5f997e881ebcc8765d1ddd3cc7d921b 316372 libdevel optional libbson-dev_1.30.4-1+deb13u5_riscv64.deb
 78dedd3ddb1de3de733404b7fcab3b25 1610808 debug optional libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_riscv64.deb
 4fffb543c1da096e43af47a7ccd19258 405324 libs optional libmongoc-1.0-0t64_1.30.4-1+deb13u5_riscv64.deb
 cf510dbc5d12b0e5c0515acb77068981 1050552 libdevel optional libmongoc-dev_1.30.4-1+deb13u5_riscv64.deb
 ef1a9fac53761ee4349c79540c46e56d 10498 libs optional mongo-c-driver_1.30.4-1+deb13u5_riscv64-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEgLDDByWcR07HDSHyNVgvumj7+mMFAmr49isACgkQNVgvumj7
+mMNbw//U9yUn/kpeW4R41DXsU3qRN5Kzfp4Apk4Y6fXgwjmDR5j21DzAmFm/oSE
99FcZuSZ+KyEyqdZabzszr3a03i3arW/g4xmgT4pAsNpm6/qRBB8pVWFKJm/CjWi
VAPpOkvZsrWN6flgLkiwkCynO2UVu/t9aSpBm3wUws9QvknqUZGQTSlY7ylZ4riV
NwwXr2GsGBheQLWbEspbgRWx3s54E1yoLTdVx2lIp5VvS5NwCLT4MQ6mQLiF8jE1
vbSKsbFiLa/1n8vyJe6/tjX0dVZU+bkO+eXNLqLFt2LC6Ai2CrCnWsDJFf8LvEXP
LUPn1wSlC4I8yf0yvYjqo0w8hrE3FqAJ6p9/Rl9lAmQiHpVFdgCx516nSjqxn7f4
InOvcHC83xy1duPLGTk+9A/DUvggERcCg3bqdFjN79D+PZ+K+RsBoMnhHdmnlFPP
4/Yo8wCLhd1oWRL/YGKBOpTr8wtQhx1ye6mDY2bms+GjtVbxpV0resB4MB0uIA7o
DjUVVzWTjj8tKIlSx/LBZBTuFKpQLPy+MD25Y5z1Tb08QxMcJGALwIHIFa5bQPLa
9xThMzaJo6zvoFRHTXxOSY+ieP4WcLV6SbScDFfmfIekW0RCge83qH5tG0lZi231
sO2QQS6/K+AtA6PIpB5a1LWZ3QVzgGIrrkVAinGqYuWQ0SmKUEc=
=teGJ
-----END PGP SIGNATURE-----