Hi,

The following vulnerability was published for php-mongodb.

CVE-2026-84968[0]:
| An out-of-bounds read in the BSON decoding component of the MongoDB
| PHP driver may allow an unauthenticated party who supplies specially
| formed input to have a small amount of adjacent process memory
| copied into an error message that is returned to application code.
| This may result in unintended disclosure of limited memory contents.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-84968
https://www.cve.org/CVERecord?id=CVE-2026-84968
[1] https://jira.mongodb.org/browse/PHPC-2744
[2] https://github.com/mongodb/mongo-php-driver/commit/44f68614e0a859a0d880811e3f93c2a02330c565

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore