Fedora Security Advisories

• corosync-3.1.10-3.fc43

Fix CVE-2026-81666 and CVE-2026-81665

• corosync-3.1.10-6.fc44

Fix CVE-2026-81666 and CVE-2026-81665

• corosync-3.1.10-8.fc45

Fix CVE-2026-81666 and CVE-2026-81665

• php-pecl-mongodb2-2.5.2-1.fc45

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.

• PHPC-2742: Bump libmongocrypt to 1.20.2 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2051
• PHPC-2755: Fix test suite failures with PHP 8.6 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2056
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v2.4] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2060
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v1.21] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2059

• php-pecl-mongodb2-2.5.2-1.el10_4

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.

• PHPC-2742: Bump libmongocrypt to 1.20.2 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2051
• PHPC-2755: Fix test suite failures with PHP 8.6 by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2056
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v2.4] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2060
• PHPC-2745: Reject null bytes in namespaces and periods in database names [v1.21] by @GromNaN in https://github.com/mongodb/mongo-php-driver/pull/2059

Release Highlights

• Add support for stringOpts in ClientEncryption::encrypt() in #2033 by @GromNaN
• Support object cloning for ReadConcern, ReadPreference, and WriteConcern in #2002 by @GromNaN

• php-pecl-mongodb2-2.5.2-1.el10_3

• PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968

• perl-Protocol-HTTP2-1.14-1.fc43

This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and a license wording.

• perl-Protocol-HTTP2-1.14-1.fc44

This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and a license wording.

• perl-Protocol-HTTP2-1.14-1.fc45

This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and a license wording.

• mongo-c-driver-1.30.9-1.el10_2

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-1.30.9-1.el9

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-1.30.9-1.fc44

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-1.30.9-1.fc43

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-1.30.9-1.el8

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

• mongo-c-driver-2.5.2-1.el10_3

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

Fixes

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)

New Features

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.
• Add collection bulk write getters.

• mongo-c-driver-2.5.2-1.el10_4

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

Fixes

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)

New Features

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.
• Add collection bulk write getters.

• mongo-c-driver-2.5.2-1.fc45

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

Fixes

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)

• libmongocrypt-1.20.4-1.el10_3

Fixed

• Reject undersized decryption payloads. CVE-2026-84971

Fixed

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

• libmongocrypt-1.20.4-1.el10_4

Fixed

• Reject undersized decryption payloads. CVE-2026-84971

Fixed

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).

• libmongocrypt-1.20.4-1.fc45

Fixed

• Reject undersized decryption payloads. CVE-2026-84971

Fixed

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81523).