Hi,

The following vulnerability was published for mongo-c-driver.

CVE-2026-93393[0]:
| A heap-based buffer overflow exists in the TLS transport layer of
| the MongoDB C Driver when built with the Windows platform TLS
| backend. A remote endpoint that the client connects to can cause the
| driver to write uncontrolled data outside the bounds of a heap
| allocation while processing incoming encrypted traffic after the TLS
| handshake completes. No authentication or user interaction is
| required, because the affected processing occurs before any
| application-level authentication completes. Triggering this issue
| may lead to memory corruption in the client process, disclosure of
| adjacent heap memory, or termination of the process.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-93393
https://www.cve.org/CVERecord?id=CVE-2026-93393
[1] https://jira.mongodb.org/browse/CDRIVER-6417

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hi Salvatore,

Note that this vulnerability only exists when mongo-c-driver is built
with components that are only available on Windows. Based on that, I
would recommend that this vulnerability be triaged as <unimportant>. (I
don't think that we have support for a does-not-affect-debian-binary
state yet.)

The fix will be included in the next unstable upload (either 2.5.5 or
2.6.0, I forget which is coming next). But it is not worth the
effort/risk to backport the fix to trixie and bookworm.

Regards,

Hi Roberto,

Ah right, thanks for for reporting back!

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
mongo-c-driver, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148331@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Roberto C. Sanchez <roberto@connexer.com> (supplier of updated mongo-c-driver package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 24 Sep 2026 12:45:04 -0400
Source: mongo-c-driver
Architecture: source
Version: 2.5.5-1
Distribution: unstable
Urgency: medium
Maintainer: Mongo C Driver Team <mongo-c-driver-debian@googlegroups.com>
Changed-By: Roberto C. Sanchez <roberto@connexer.com>
Closes: 1148331
Changes:
 mongo-c-driver (2.5.5-1) unstable; urgency=medium
 .
   * New upstream release (Closes: #1148331)
Checksums-Sha1:
 13e5f44a3af7aaba7020671028423282de20a026 2697 mongo-c-driver_2.5.5-1.dsc
 082956724688b89e59074fc0bbeeb691bd5e51db 7150611 mongo-c-driver_2.5.5.orig.tar.gz
 3fa06648148eaf8a2afb7536eac8b90edd5c3e93 10184 mongo-c-driver_2.5.5-1.debian.tar.xz
 cae3e7e530c9da17f5e43f36e04b7095a402c581 7152 mongo-c-driver_2.5.5-1_source.buildinfo
Checksums-Sha256:
 a828b5150ce8731b98ace12ca4257cce9a87ad9f2e65ff6cfff0355fb50775c3 2697 mongo-c-driver_2.5.5-1.dsc
 479ec7a09e30c600929c0082268566e3476878ff6eae7635622ad59458429755 7150611 mongo-c-driver_2.5.5.orig.tar.gz
 1e9d96e02e92296d85d44c728927ae0c88f16f048984a3009b69d2d777392498 10184 mongo-c-driver_2.5.5-1.debian.tar.xz
 8d25c11e3ff0d1dad733501b9bf0756301845a7fc99afea9d5182ac9986c92a9 7152 mongo-c-driver_2.5.5-1_source.buildinfo
Files:
 10bf2ca83ebded05ed68eaee49db163d 2697 libs optional mongo-c-driver_2.5.5-1.dsc
 c77832e405951ea019ce304abc5ea8a2 7150611 libs optional mongo-c-driver_2.5.5.orig.tar.gz
 61f8eb0f89fff2aa44807a0de924bd3b 10184 libs optional mongo-c-driver_2.5.5-1.debian.tar.xz
 2e97bb4a52dfb488412bcbf647f00338 7152 libs optional mongo-c-driver_2.5.5-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEIYZ1DR4ae5UL01q7ldFmTdL1kUIFAmq1Z3oACgkQldFmTdL1
kUKeHA//cnUUKa2q3MXJR3hQ1tV4SVAq+4cvjpBQUvLf8Af1t+R1ii3GRd6R+vnt
skovKHdZQTRTF0Fxk03m5vCGDvkCGVn7FtdV8ajSruB/ZHsl8zmZQFubO4ndJZxI
52ZpBuEM7+s1PuWbq/sq1jfxbKXz07078wrH9ngttSPE4eydpD4tJ0qfkHDHyT18
wyrUFeFnvOU+gXQvpa947L/3cgtY39Q3KUANqbCZWxHwM0rIEsPWrOkrdofu/6eG
0KAqbQw9/V2GXhirwm69eTFCUKGmaO3E441Q8hcstuSIrhGccjMi0lrRGLz+zDOB
Dr43uxAC60zsnFRdj81lNUd5UKm+NcJMBpg7LE6SdAqhpmPGVoPTi0cR6jkoPNTx
Lp/bVr1gVbHAi8VlwGhjjBOvzP7V0zrZZom7bLoUtaOMpZ5RZX4VF+Y3iEcTTuAL
/dTmFnP4INhW8jtBG3aBdsS7Kv0+pNyQAF+l7C+xtqa600r0kcp8XahHhkGtX8rg
q+NyG/bXf7iE3u6yXri4coEqN2JqgQ/nIviL8jLH02363ChRYSyLJY31u/0IuIIk
MFQ3O7IUkZTG9lSQIW3tBVS4V1LbynOGHMZNKQaRNXTGqgC7Dt7xS4OTpFQCnzY4
LG6wmTmtwwslwwtqhpI4oLdCRb//EmsBZvMSeAIsiZZpFD9ay10=
=K9pM
-----END PGP SIGNATURE-----