Skip to content

GHSA-fqmh-x7gg-pfgw on Cyberus Linux 26.05

Aliases: GHSA-fqmh-x7gg-pfgw, CVE-2026-84969

Packages: mongoc

Status: Resolved

Advisory Information

Impact

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

Patches

Fixed in 1.30.9 and 2.5.2

Workarounds

Disable logging or logging truncation.

References

https://jira.mongodb.org/browse/CDRIVER-6410

Updates

2026-09-10 18:45 CEST

Metadata changes:

  • Status for package mongoc: “Resolved” (3cab78fc1baa66320c23f55f1f0c8153155be888)

2026-09-10 18:44 CEST

Metadata changes:

  • Status for package mongoc: “New”