Hi,

The following vulnerabilities were published for pymongo.

CVE-2026-96747[0]:
| The client-side field level encryption support in the MongoDB Python
| Driver can treat a key management endpoint value ending in ".sock"
| as a local Unix domain socket path rather than a remote host. A user
| with write access to the encryption key metadata stored in the
| database can cause an application using the driver to open
| connections to local sockets on the application host. Data sent over
| these connections is limited to the start of a TLS handshake, so no
| chosen content is transmitted.


CVE-2026-96748[1]:
| PyMongo's connection string parsing decodes percent-encoded
| characters in the host portion before the host list is separated on
| its delimiters. When an application places a hostname value supplied
| by an unauthenticated party into a connection string, that party may
| cause additional servers of their choosing to be added to the
| application's database client. The application may then send its
| authentication exchange and database operations to one of those
| servers, which can observe limited information and return altered
| results.


CVE-2026-96749[2]:
| An integer overflow in the BSON document encoding component of the
| MongoDB Python Driver's bundled native extension may occur when a
| single document is built from an unusually large amount of caller-
| supplied data. Size arithmetic is performed in a signed 32-bit type,
| and the guard meant to catch the overflow is written in a form whose
| behavior is not defined by the C language standard. A party with no
| privileges who can place a very large value into data that an
| application encodes may, depending on how the native extension was
| built, cause a write outside the bounds of an allocated buffer
| inside the application's own process.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-96747
https://www.cve.org/CVERecord?id=CVE-2026-96747
[1] https://security-tracker.debian.org/tracker/CVE-2026-96748
https://www.cve.org/CVERecord?id=CVE-2026-96748
[2] https://security-tracker.debian.org/tracker/CVE-2026-96749
https://www.cve.org/CVERecord?id=CVE-2026-96749

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
pymongo, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148967@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aryan Karamtoth <spaciouscoder78@disroot.org> (supplier of updated pymongo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 07 Oct 2026 09:15:45 +0530
Source: pymongo
Architecture: source
Version: 4.18.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Aryan Karamtoth <spaciouscoder78@disroot.org>
Closes: 1148967
Changes:
 pymongo (4.18.2-1) unstable; urgency=medium
 .
   * New upstream version 4.18.2
   * Introduce upstream fix for multiple CVEs (Closes: #1148967)
Checksums-Sha1:
 5d839508ae3ffb52645ffa49fd086e2138ee4c3e 2565 pymongo_4.18.2-1.dsc
 04ef077a377858d36b62d4ebe62deb60c4a2dc36 2824953 pymongo_4.18.2.orig.tar.gz
 c3464a92f6e86fbadf8ea0956f972d2a1b4b46a6 7528 pymongo_4.18.2-1.debian.tar.xz
 e2436ca9ba8f1ae5b5b20bd6cde13f6eb2d23f38 10044 pymongo_4.18.2-1_amd64.buildinfo
Checksums-Sha256:
 2de8545aba8b41a3c3f92dbca14305ec8e89594084ba014683a6460bf5d7c5d1 2565 pymongo_4.18.2-1.dsc
 2c71c1500a1f5387efa5212db008a9837ef36d2fee6cd6a8ef16160a970b384b 2824953 pymongo_4.18.2.orig.tar.gz
 ccc6116057ba25ef481683752b8f18e8a9136ed4838abb8ba01ec04a32991977 7528 pymongo_4.18.2-1.debian.tar.xz
 2447aed9c1351f62208dafe10e8bde4d9e0d8926156e3e2beac910e35c495855 10044 pymongo_4.18.2-1_amd64.buildinfo
Files:
 8a600c5fa3abe04b356b51fbe1c6d6b1 2565 python optional pymongo_4.18.2-1.dsc
 27df4de96872ffd7b38fe19a249f3d2a 2824953 python optional pymongo_4.18.2.orig.tar.gz
 b963bea089ebc7542b9a5c8de8bf1187 7528 python optional pymongo_4.18.2-1.debian.tar.xz
 cbceb7f704a4bddd76874ec7fb138ba7 10044 python optional pymongo_4.18.2-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEen2TCCvRm6+oO340/pAHuO1kBCEFAmrF6aIACgkQ/pAHuO1k
BCENoBAAivrNIivd443hIqOgCkcUb7fX3O7rhKG2yktUckZIuzDqJ8ePSxerJXGC
a/RvQSPa2THD4/t/kYYITITT6W36z5dT+hlMdlIODkCiCv6XL2J4vv0L+x4ZsZ4c
BbAJmw0hgsbjYgjyEitRxPlf4HFnYyh4z8j1PZVvTV0qpiQfxQZWYQ989tCCrSA2
P8wlt93yZCuL2tZEhhGROmZK2CREaDU2Ub2yRtZuUxBw9LdLVNiSKpJMsZwIMVnM
1VzOcfTWEL00dRO30O5aaeVAL1HACpmIfco1ilzinJWQMwoGAp02m3SWCdWFYCCz
dgpepE+HQC7DUmtftwy6WCW7sKxIKwceJTrnt/gqbCcK90SH0IpWIiyUyMOJ6i0r
UFYdx7jiPNw3mCkGa4S0gmxU6ZvAIcFmXtPW+xyiHnM7uhQegdTcaU/NTBZTemx1
1kVtMiQNAUiP0PUnG76C2tE2t/u8un8bj/V+cKGWqmb4TaAtYKzL52KBuNlEIiwu
7thCAZvGxSV1gd9TNm2rqISO8h+8gmt+hxFMmT3/PUKfR7IqommpoUon4E0D+2Sy
OjnCDXiuKwJX3b2VxRIrI/bVdMlmuHfRmBFpvd1cQm8BeY3HkSB63VFS5Nu/HuNi
J6aVStVTd1paXJC6n1zC6ZwVU1wwCg031hENskgPkKsp+knNW9g=
=XFQ3
-----END PGP SIGNATURE-----