-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 01 Oct 2026 08:25:18 +0200
Source: php-mongodb
Architecture: source
Version: 2.0.0-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian PHP PECL Maintainers <team+php-pecl@tracker.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Changes:
 php-mongodb (2.0.0-1+deb13u1) trixie-security; urgency=high
 .
   * PHPC-2744: Fix out-of-bounds read of field path
    + [CVE-2026-84968]: An out-of-bounds read in the BSON decoding
      component of the MongoDB PHP driver may allow an unauthenticated
      party who supplies specially formed input to have a small amount of
      adjacent process memory copied into an error message that is returned
      to application code. This may result in unintended disclosure of
      limited memory contents.
   * PHPC-2743: Fix __pclass inference in events
    + [CVE-2026-96745]: Deserialization of untrusted data in the command
      monitoring support of the MongoDB PHP Driver can cause class names
      embedded in document content to be honored when the driver builds
      monitoring event objects.
   * PHPC-2636: Respect libbson nesting limit when parsing PHP objects
    + [CVE-2026-6811]: Stack exhaustion vulnerability in the MongoDB PHP
      driver can cause application crashes when processing deeply nested
      BSON documents in unusual circumstances when the source of these BSON
      documents is not MongoDB Server.
Checksums-Sha1:
 dd57e74f4da3c5d4e7087f3d1e3499e816424da7 2408 php-mongodb_2.0.0-1+deb13u1.dsc
 b7960c0671e928a07c8d60b4b4a3cb0823617239 2109177 php-mongodb_2.0.0.orig.tar.gz
 e8b54471bce5212ad75951d7ec44f0b5849d090f 14764 php-mongodb_2.0.0-1+deb13u1.debian.tar.xz
 0a13d26fe25c401b2335f0db3bfc98b5ef26eacf 8555 php-mongodb_2.0.0-1+deb13u1_amd64.buildinfo
Checksums-Sha256:
 24279015de663838340e40c3584e89625289fb187ad402ceda9055b165410de9 2408 php-mongodb_2.0.0-1+deb13u1.dsc
 6a53987a5e75fc65d032ac93cc8d4522a5cd06e068828e6b6e12612597fc88df 2109177 php-mongodb_2.0.0.orig.tar.gz
 2aa0ae4b0d75fd2bded5e4ca9aca8b76a54a4cc8c6bd20516fa51b2278b44c76 14764 php-mongodb_2.0.0-1+deb13u1.debian.tar.xz
 cba24fe1488e53c26a827b78d8d79337ff726f896f6df30d722ae9211f9c16cb 8555 php-mongodb_2.0.0-1+deb13u1_amd64.buildinfo
Files:
 224a0343758028163322c9c88168ea6b 2408 php optional php-mongodb_2.0.0-1+deb13u1.dsc
 792a1acdc4e247cf5c8dad0f3b12b931 2109177 php optional php-mongodb_2.0.0.orig.tar.gz
 874e923bb400cc43090d0c916f3026c1 14764 php optional php-mongodb_2.0.0-1+deb13u1.debian.tar.xz
 0b2f928bb0a1d364db84f150d20be92d 8555 php optional php-mongodb_2.0.0-1+deb13u1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmq+AYFfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
WcKOCg//Q0pX0Z85zmQyj/vkj6vmOE0Y0TP+HjsMWI0QBZr63ATK+lIloE2fJTev
osVENDgDmtvJdVUFsMHOLjoasHz6DIRrwenkoX0uStZPsLxUeDAzcZmzvpN1gL/L
tPWbkjKuLNgw05T+Jcw5mwjFBGpan4z+qakcl1pcblzy76fhYfiZ7rs+kJkD0dgH
2jj0JZtEGnEdX4GDJigZIe5ac65KuZ0QMOdM8CRCoCzWsOWhXVygJj8dYPZAAP4F
oWXVh2F6UXEGFTlCQNiQZoqZTJ1J4dQeeqN+aKzTsBQk9KQjFwZ3uB5rq0BSJzHf
IXLAV4BZPlE6VjS4D8yxh1Xp+sCIrxvbl4YXAp2sFOipmIUwLZSy9pFGqKzUQZfy
I1ZJIPrcFT/98omq18XK42H6Yd4GvsfGldJ5cdKhWCu9HyzZNlzl25YWCgrJAx6z
lAqpu+vxm/euAVLm2h4iQpbl7rlaX8nxxWj4hbSIsnvXkcknUOgLNhfezhrudVTU
X9V50lGmg/yGTaTSwqVyys1dGPN0Ha2naT+o+WX839jC3ewcZvsjMvHlNbcNVzCA
XhSrAREa0o81gw/Ct4r6EQu0F/D5UKMMjULi3XscAlecs2wP2QAIzLIIhsnwREtd
0UN0HGfxmZ3nNjOkUjYyMaLii5mxj/3hvbApHI4X4OXtWjkMAM8=
=9keu
-----END PGP SIGNATURE-----