Aggregator

mongo-c-driver-2.5.8-1.fc45

Fedora Security Advisories
5 days 10 hours ago
FEDORA-2026-4701fdc782 Packages in this update:
  • mongo-c-driver-2.5.8-1.fc45
Update description: libbson version 2.5.8

Fixes

  • Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954
libmongoc version 2.5.8

Fixes

  • Fix abort when parsing a cursor namespace without a dot separator.
  • Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
  • Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
  • Fix a missing bounds check when reading GridFS files. CVE-2026-120684
  • Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
  • Report writeConcernError consistently, as mandated by the CRUD spec.

mongo-c-driver-2.5.8-1.el10_4

Fedora Security Advisories
5 days 10 hours ago
FEDORA-EPEL-2026-0da73d1b5b Packages in this update:
  • mongo-c-driver-2.5.8-1.el10_4
Update description: libbson version 2.5.8

Fixes

  • Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954
libmongoc version 2.5.8

Fixes

  • Fix abort when parsing a cursor namespace without a dot separator.
  • Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
  • Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
  • Fix a missing bounds check when reading GridFS files. CVE-2026-120684
  • Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
  • Report writeConcernError consistently, as mandated by the CRUD spec.

mongo-c-driver-2.5.8-1.el10_3

Fedora Security Advisories
5 days 10 hours ago
FEDORA-EPEL-2026-8663de05d3 Packages in this update:
  • mongo-c-driver-2.5.8-1.el10_3
Update description: libbson version 2.5.8

Fixes

  • Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954
libmongoc version 2.5.8

Fixes

  • Fix abort when parsing a cursor namespace without a dot separator.
  • Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
  • Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
  • Fix a missing bounds check when reading GridFS files. CVE-2026-120684
  • Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
  • Report writeConcernError consistently, as mandated by the CRUD spec.

mongo-c-driver-1.30.15-1.fc44

Fedora Security Advisories
5 days 10 hours ago
FEDORA-2026-43d95b04a7 Packages in this update:
  • mongo-c-driver-1.30.15-1.fc44
Update description: libmongoc 1.30.15

Fixes

  • Fix abort when parsing a cursor namespace without a dot separator.
  • Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
  • Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
  • Fix a missing bounds check when reading GridFS files. CVE-2026-120684
  • Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
  • Report writeConcernError consistently, as mandated by the CRUD spec.

mongo-c-driver-1.30.15-1.el8

Fedora Security Advisories
5 days 10 hours ago
FEDORA-EPEL-2026-a98d3339c8 Packages in this update:
  • mongo-c-driver-1.30.15-1.el8
Update description: libmongoc 1.30.15

Fixes

  • Fix abort when parsing a cursor namespace without a dot separator.
  • Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
  • Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
  • Fix a missing bounds check when reading GridFS files. CVE-2026-120684
  • Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
  • Report writeConcernError consistently, as mandated by the CRUD spec.

mongo-c-driver-1.30.15-1.el10_2

Fedora Security Advisories
5 days 10 hours ago
FEDORA-EPEL-2026-8865b24891 Packages in this update:
  • mongo-c-driver-1.30.15-1.el10_2
Update description: libmongoc 1.30.15

Fixes

  • Fix abort when parsing a cursor namespace without a dot separator.
  • Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
  • Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
  • Fix a missing bounds check when reading GridFS files. CVE-2026-120684
  • Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
  • Report writeConcernError consistently, as mandated by the CRUD spec.

mongo-c-driver-1.30.15-1.fc43

Fedora Security Advisories
5 days 10 hours ago
FEDORA-2026-be6a432dc3 Packages in this update:
  • mongo-c-driver-1.30.15-1.fc43
Update description: libmongoc 1.30.15

Fixes

  • Fix abort when parsing a cursor namespace without a dot separator.
  • Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
  • Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
  • Fix a missing bounds check when reading GridFS files. CVE-2026-120684
  • Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
  • Report writeConcernError consistently, as mandated by the CRUD spec.

mongo-c-driver-1.30.15-1.el9

Fedora Security Advisories
5 days 10 hours ago
FEDORA-EPEL-2026-318de46435 Packages in this update:
  • mongo-c-driver-1.30.15-1.el9
Update description: libmongoc 1.30.15

Fixes

  • Fix abort when parsing a cursor namespace without a dot separator.
  • Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
  • Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
  • Fix a missing bounds check when reading GridFS files. CVE-2026-120684
  • Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
  • Report writeConcernError consistently, as mandated by the CRUD spec.

perl-CGI-5.02-1.fc45

Fedora Security Advisories
5 days 11 hours ago
FEDORA-2026-a04615c725 Packages in this update:
  • perl-CGI-5.02-1.fc45
Update description:

5.02 bump - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex) - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type) - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits) - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS) - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups) - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references) - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values) - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ";" injected attributes) - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes) - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host) - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it) - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs) - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical) - Fix CVE-2026-120648 (comment() text could end HTML comment) - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs) - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling) - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk) - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field) - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values) - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

perl-CGI-5.02-1.fc44

Fedora Security Advisories
5 days 11 hours ago
FEDORA-2026-516e427bac Packages in this update:
  • perl-CGI-5.02-1.fc44
Update description:

5.02 bump - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex) - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type) - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits) - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS) - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups) - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references) - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values) - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ";" injected attributes) - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes) - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host) - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it) - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs) - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical) - Fix CVE-2026-120648 (comment() text could end HTML comment) - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs) - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling) - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk) - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field) - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values) - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

perl-CGI-5.02-1.fc43

Fedora Security Advisories
5 days 11 hours ago
FEDORA-2026-a3a026d9ff Packages in this update:
  • perl-CGI-5.02-1.fc43
Update description:

5.02 bump - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex) - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type) - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits) - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS) - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups) - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references) - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values) - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ";" injected attributes) - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes) - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host) - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it) - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs) - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical) - Fix CVE-2026-120648 (comment() text could end HTML comment) - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs) - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling) - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk) - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field) - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values) - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)