Skip to content

GHSA-h2g7-2gxh-c5v2 on Cyberus Linux 26.05

Aliases: GHSA-h2g7-2gxh-c5v2, CVE-2026-84965

Packages: mongoc

Status: Resolved

Advisory Information

Impact

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.

Patches

Fixed in 1.30.9 and 2.5.1.

Workarounds

Check length of input JSON prior to parsing.

References

https://jira.mongodb.org/browse/CDRIVER-6405

Updates

2026-09-10 18:45 CEST

Metadata changes:

  • Status for package mongoc: “Resolved” (3cab78fc1baa66320c23f55f1f0c8153155be888)

2026-09-10 18:44 CEST

Metadata changes:

  • Status for package mongoc: “New”