Skip to content

GHSA-c9qr-rh56-vvrc on Cyberus Linux 26.05 (unsupported)

Aliases: GHSA-c9qr-rh56-vvrc, CVE-2026-81524

Packages: mongoc

Status: Acknowledged

Advisory Information

Impact

Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.

Patches

Fixed in C driver 2.5.1.

Workarounds

Validate database and collection names prior to passing into APIs.

References

https://jira.mongodb.org/browse/CDRIVER-6424

Updates

2026-09-10 18:40 CEST

Metadata changes:

  • Status for package mongoc: “Acknowledged”

Comment:

Status for the r1.30 branch is unclear.

The CVE information and the GHSA information both point at any version prior to 2.5.1 being affected, which would include the r1 series.

A cursory look at the codebase seems to indicate the locations where the fix was applied look similar.

(Amended on: 2026-09-10 18:42 CEST)

2026-09-10 18:40 CEST

Metadata changes:

  • Status for package mongoc: “New”