mongo-c-driver - Debian Package Tracker

general

source: mongo-c-driver (main)
version: 2.5.3-1
maintainer: Mongo C Driver Team (DMD)
uploaders: Roberto C. Sanchez [DMD] – Kevin Albertson [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.17.6-1
o-o-sec: 1.17.6-1+deb11u2
oldstable: 1.23.1-1+deb12u3
stable: 1.30.4-1+deb13u2
testing: 2.5.3-1
unstable: 2.5.3-1

versioned links

1.17.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.17.6-1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.23.1-1+deb12u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.30.4-1+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.5.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libbson-dev
libbson-doc
libbson2-2
libmongoc-dev
libmongoc-doc
libmongoc2-2

action needed

Marked for autoremoval on 18 October due to python-pytest-cov: #1145179, #1145349 high

Version 2.5.3-1 of mongo-c-driver is marked for autoremoval from testing on Sun 18 Oct 2026. It depends (transitively) on python-pytest-cov, affected by #1145179, #1145349. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-09-18 Last update: 2026-09-19 07:02

9 security issues in trixie high

There are 9 open security issues in trixie.

3 important issues:

CVE-2026-93393: A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.
CVE-2026-93394: A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.
CVE-2026-93395: A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.

6 issues left for the package maintainer to handle:

CVE-2026-84963: (needs triaging) An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.
CVE-2026-84964: (needs triaging) A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.
CVE-2026-84965: (needs triaging) An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.
CVE-2026-84969: (needs triaging) A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.
CVE-2026-88035: (needs triaging) A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.
CVE-2026-88036: (needs triaging) Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-09-04 Last update: 2026-09-19 07:02

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-93393: A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.

Created: 2026-09-18 Last update: 2026-09-19 07:02

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-93393: A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.

Created: 2026-09-18 Last update: 2026-09-19 07:02

9 security issues in bookworm high

There are 9 open security issues in bookworm.

8 important issues:

CVE-2026-84963: An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.
CVE-2026-84964: A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.
CVE-2026-84965: An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.
CVE-2026-88035: A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.
CVE-2026-88036: Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
CVE-2026-93393: A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.
CVE-2026-93394: A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.
CVE-2026-93395: A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.

1 issue postponed or untriaged:

CVE-2026-81524: (postponed; to be fixed through a stable update) A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.

Created: 2026-08-28 Last update: 2026-09-19 07:02

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In debian/watch no matching files for watch source
  https://github.com/mongodb/mongo-c-driver/releases

Created: 2026-09-12 Last update: 2026-09-19 03:31

Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

debian/changelog not found in any branch (tried master, debian, debian/master, debian/sid, debian/latest, debian/experimental, master)

Created: 2024-02-04 Last update: 2026-09-18 20:33

6 security issues in bullseye high

There are 6 open security issues in bullseye.

2 important issues:

CVE-2026-9100: The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).
CVE-2026-81524: A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.

4 issues postponed or untriaged:

CVE-2026-4359: (postponed; to be fixed through a stable update) A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.
CVE-2026-6231: (postponed; to be fixed through a stable update) The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1
CVE-2026-6691: (postponed; to be fixed through a stable update) The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.
CVE-2025-14911: (postponed; to be fixed through a stable update) User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container.

Created: 2026-05-20 Last update: 2026-08-30 08:30

Multiarch hinter reports 3 issue(s) normal

There are issues with the multiarch metadata for this package.

libbson-doc could be marked Multi-Arch: foreign
libmongoc-doc could be marked Multi-Arch: foreign
libbson2-2 could be marked Multi-Arch: same

Created: 2018-11-07 Last update: 2026-09-19 03:33

lintian reports 1100 warnings normal

Lintian reports 1100 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-04 Last update: 2026-09-04 12:01

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-09-12 16:32

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-09-16] mongo-c-driver 2.5.3-1 MIGRATED to testing (Debian testing watch)
[2026-09-10] Accepted mongo-c-driver 2.5.3-1 (source) into unstable (Roberto C. Sanchez)
[2026-09-09] mongo-c-driver 2.5.2-1 MIGRATED to testing (Debian testing watch)
[2026-09-04] Accepted mongo-c-driver 1.30.4-1+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Roberto C. Sanchez)
[2026-09-03] Accepted mongo-c-driver 2.5.2-1 (source) into unstable (Roberto C. Sanchez)
[2026-09-02] mongo-c-driver 2.5.1-1 MIGRATED to testing (Debian testing watch)
[2026-08-28] mongo-c-driver 2.5.0-1 MIGRATED to testing (Debian testing watch)
[2026-08-27] Accepted mongo-c-driver 2.5.1-1 (source) into unstable (Roberto C. Sanchez)
[2026-08-21] Accepted mongo-c-driver 2.5.0-1 (source) into unstable (Roberto C. Sanchez)
[2026-08-18] Accepted mongo-c-driver 2.4.0-1 (source) into unstable (Roberto C. Sanchez)
[2026-07-20] mongo-c-driver 2.3.3-1 MIGRATED to testing (Debian testing watch)
[2026-07-14] Accepted mongo-c-driver 2.3.3-1 (source) into unstable (Roberto C. Sanchez)
[2026-07-13] mongo-c-driver 2.3.2-1 MIGRATED to testing (Debian testing watch)
[2026-07-07] Accepted mongo-c-driver 2.3.2-1 (source) into unstable (Roberto C. Sanchez)
[2026-06-09] mongo-c-driver 2.3.1-1 MIGRATED to testing (Debian testing watch)
[2026-06-03] Accepted mongo-c-driver 2.3.1-1 (source) into unstable (Roberto C. Sanchez)
[2026-05-04] Accepted mongo-c-driver 1.23.1-1+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Roberto C. Sanchez)
[2026-05-04] Accepted mongo-c-driver 1.30.4-1+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Roberto C. Sanchez)
[2026-04-28] mongo-c-driver 2.3.0-1 MIGRATED to testing (Debian testing watch)
[2026-04-22] Accepted mongo-c-driver 2.3.0-1 (source) into unstable (Roberto C. Sanchez)
[2026-04-15] mongo-c-driver 2.2.4-1 MIGRATED to testing (Debian testing watch)
[2026-04-09] Accepted mongo-c-driver 2.2.4-1 (source) into unstable (Roberto C. Sanchez)
[2026-03-09] mongo-c-driver 2.2.3-1 MIGRATED to testing (Debian testing watch)
[2026-03-03] Accepted mongo-c-driver 2.2.3-1 (source) into unstable (Roberto C. Sanchez)
[2026-02-20] mongo-c-driver 2.2.2-1 MIGRATED to testing (Debian testing watch)
[2026-02-13] Accepted mongo-c-driver 2.2.2-1 (source) into unstable (Roberto C. Sanchez)
[2026-01-14] Accepted mongo-c-driver 1.17.6-1+deb11u2 (source) into oldoldstable-security (Roberto C. Sanchez)
[2025-12-26] Accepted mongo-c-driver 1.23.1-1+deb12u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Roberto C. Sanchez)
[2025-12-20] Accepted mongo-c-driver 1.30.4-1+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Roberto C. Sanchez)
[2025-12-19] mongo-c-driver 2.2.1-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 1100)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.5.0-1
1 bug