Aggregator

• corosync-3.1.10-8.fc45

Fix CVE-2026-81666 and CVE-2026-81665

• php-pecl-mongodb2-2.5.2-1.fc45

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.

• PHPC-2742: Bump libmongocrypt to 1.20.2 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2051
• PHPC-2755: Fix test suite failures with PHP 8.6 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2056
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v2.4] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2060
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v1.21] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2059

• php-pecl-mongodb2-2.5.2-1.el10_4

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.

• PHPC-2742: Bump libmongocrypt to 1.20.2 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2051
• PHPC-2755: Fix test suite failures with PHP 8.6 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2056
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v2.4] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2060
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v1.21] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2059

Release Highlights

• Add support for stringOpts in ClientEncryption::encrypt() in #2033 by @GromNaN
• Support object cloning for ReadConcern, ReadPreference, and WriteConcern in #2002 by @GromNaN

• php-pecl-mongodb2-2.5.2-1.el10_3

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.

• PHPC-2742: Bump libmongocrypt to 1.20.2 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2051
• PHPC-2755: Fix test suite failures with PHP 8.6 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2056
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v2.4] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2060
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v1.21] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2059

Release Highlights

• Add support for stringOpts in ClientEncryption::encrypt() in #2033 by @GromNaN
• Support object cloning for ReadConcern, ReadPreference, and WriteConcern in #2002 by @GromNaN

• perl-Protocol-HTTP2-1.14-1.fc43

This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and a license wording.

• perl-Protocol-HTTP2-1.14-1.fc44

This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and a license wording.

• perl-Protocol-HTTP2-1.14-1.fc45

This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and a license wording.

• mongo-c-driver-1.30.9-1.el10_2

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-1.30.9-1.el9

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-1.30.9-1.fc44

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-1.30.9-1.fc43

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-1.30.9-1.el8

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-2.5.2-1.el10_3

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

Fixes

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)

New Features

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.
• Add collection bulk write getters.

• mongo-c-driver-2.5.2-1.el10_4

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

Fixes

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)

New Features

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.
• Add collection bulk write getters.

• mongo-c-driver-2.5.2-1.fc45

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

Fixes

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)

• libmongocrypt-1.20.4-1.el10_3

Fixed

• Reject undersized decryption payloads. CVE-2026-84971

Fixed

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

• libmongocrypt-1.20.4-1.el10_4

Fixed

• Reject undersized decryption payloads. CVE-2026-84971

Fixed

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

• libmongocrypt-1.20.4-1.fc45

Fixed

• Reject undersized decryption payloads. CVE-2026-84971

Fixed

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

• chromium-152.0.7977.75-1.el10_3

• Update to 152.0.7977.75

• CVE-2026-84353: Use after free in Shared Tab Groups

• CVE-2026-84352: Use after free in WebGL
• CVE-2026-84354: Incorrect authorization in FileSystem
• CVE-2026-84359: Information leak in Skia
• CVE-2026-84357: Improper input validation in Omnibox
• CVE-2026-84324: Use after free in Proxy
• CVE-2026-84349: Use after free in Browser
• CVE-2026-84326: Uninitialized resource in V8
• CVE-2026-84333: Use after free in Dawn
• CVE-2026-84351: Buffer overflow in GPU
• CVE-2026-84325: Improper input validation in DataTransfer
• CVE-2026-84328: Missing authorization in FileSystem
• CVE-2026-84347: Use after free in WebRTC
• CVE-2026-84323: Missing authorization in FileSystem
• CVE-2026-84355: Incorrect authorization in Navigation
• CVE-2026-84358: Improper privilege management in Downloads
• CVE-2026-84332: Incorrect authorization in SiteSettings
• CVE-2026-84330: UI misrepresentation in FullScreen
• CVE-2026-84334: Incorrect authorization in Chromoting
• CVE-2026-84348: Information leak in MediaCapture
• CVE-2026-84335: Incorrect authorization in TabStrip
• CVE-2026-84327: Incorrect authorization in Autofill
• CVE-2026-84329: Confused deputy in CredentialProvider
• CVE-2026-84356: UI misrepresentation in FullScreen
• CVE-2026-84350: Use after free in TabStrip
• CVE-2026-84331: Incorrect authorization in Actor