Hi,

The following vulnerability was published for pymongo.

CVE-2026-106435[0]:
| The MongoDB Python Driver's binary accelerator can read outside a
| buffer when an application decodes malformed BSON containing a
| truncated regular-expression element without a trailing NUL byte. An
| actor who can supply BSON to the documented decode or decode_all API
| can cause the application process to terminate when the C extension
| is loaded. The driver's normal database wire-protocol path does not
| reach this code.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-106435
https://www.cve.org/CVERecord?id=CVE-2026-106435
[1] https://jira.mongodb.org/browse/PYTHON-6110
[2] ttps://github.com/mongodb/mongo-python-driver/commit/bb8d4e195275e75bd94ebeffb53cc747d357fcf4

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
pymongo, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150462@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aryan Karamtoth <spaciouscoder78@disroot.org> (supplier of updated pymongo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 22 Oct 2026 10:37:29 +0530
Source: pymongo
Architecture: source
Version: 4.19.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Aryan Karamtoth <spaciouscoder78@disroot.org>
Closes: 1150462 1150621
Changes:
 pymongo (4.19.0-1) unstable; urgency=medium
 .
   [Federico Molara]
   * New upstream bug fix release.
     - Bound C BSON regular-expression scans to the remaining document bytes
       (CVE-2026-106435). (Closes: #1150462)
 .
   * Adopt the package within the Debian Python Team; add myself to Uploaders
     and retain Aryan Karamtoth. (Closes: #1150621)
 .
   [Aryan Karamtoth]
   * New upstream release 4.19.0
Checksums-Sha1:
 4747e443b7457d46648167bf3ef46ff29a4fd516 2604 pymongo_4.19.0-1.dsc
 fcf32911e6c85720b7b03d9089d8b5ab34543284 2764823 pymongo_4.19.0.orig.tar.gz
 afd50d6c14d473f0bb41e746e37ac4e90aeb492f 7680 pymongo_4.19.0-1.debian.tar.xz
 f58c22b6d9ec6b29ec938f76676ed92841d7b7b7 9972 pymongo_4.19.0-1_amd64.buildinfo
Checksums-Sha256:
 bcf516e9fa097bab845144b59b3515876fdc10730bd8793505605ca332a5d296 2604 pymongo_4.19.0-1.dsc
 a0fef4bd7074a4339b31473867ce117f9156b9485c16ca7df9a0ff919306c9b3 2764823 pymongo_4.19.0.orig.tar.gz
 76a9bd13e9f04bbb666847140e5e267e820af790fc6c640b290968a47944f89d 7680 pymongo_4.19.0-1.debian.tar.xz
 4df9763407222efd44881b0a4bf4e0c9186b348e107ca5de4db20af7b22f42f3 9972 pymongo_4.19.0-1_amd64.buildinfo
Files:
 28b7938b92dc28578e685b4b0a908421 2604 python optional pymongo_4.19.0-1.dsc
 05e0611f12e69189558f0b8e6dfebb09 2764823 python optional pymongo_4.19.0.orig.tar.gz
 94df4b809bc8177abe2db6348f4ebe1f 7680 python optional pymongo_4.19.0-1.debian.tar.xz
 cc29e21cc9c33fd3efdf5aa441622086 9972 python optional pymongo_4.19.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEen2TCCvRm6+oO340/pAHuO1kBCEFAmrZpyMACgkQ/pAHuO1k
BCHxag//bIjWkr0rYghmD/SDIkAcvP2NT/dj2qcMoCy46VZSwu03qlrJIACx3JgI
mdRmMC8PeheiXasHsIc3CBSyZzALrIotdw9KWD048r57I/tdmxDxS8o1hFN5r5qR
lzEP4Q8wC7JzrO4XctoQ7h8a6ECAlXyH1K9FP6aTmJnjsYoo2075J55f88HD0gPo
xu+C2vvqtXbl1XUMoFXauxfsbjj6w6QCDn2hUXKgCsccisX35jM+ZhhsgXkn12FC
7acjN8VqHe3MJrHCH2G9EDhU0OlviQp+EA2gicnKGq6MyvGnJx/IOTxqguI9kHjj
pP6QiekKgHmRjLjLc9v5TcxsT7GbDHTqifPMVLUupQHzOhJQ05G2GSu24W+dC75t
51upriiMIdBAy8szTaFUUGdYCzHGChfo3Jx3+GK69/uLiGZMe9oRKDAHOKxJFdsH
g3jh7CXf6elm6ybFbXYeaxnoJyEi1uf5tdQBX7c7VAIEq+6l6Lzxuxqthjr6XCI+
6nhdoDF3BSeen8VU2Toa2I+hRqkP3Rve8vIy/vy9QVj0+IcLwsy9oNvnfAKLYveX
uPptU+6Rf6ztXafIOksAdBLkbmY4rQt7HzJ/xxcpTeGwcoh9pIBmALEyNkIl+JaL
u9n1803dgX7EK243oVqouRvuSNbHbateoaVe7pDweFul61RwByQ=
=yyZE
-----END PGP SIGNATURE-----