Dear Release Team,
Please consider pymongo 4.10.1-6+deb13u1 for the next trixie point release.
I am requesting pre-approval before arranging an upload.
[ Reason ]
Backport the upstream fix for CVE-2026-106435 / #1150462 (severity
important). Trixie 4.10.1-6 contains unbounded regular-expression scans
in the native BSON decoder. The Security Tracker marks this no-dsa.
The fix entered Debian unstable in 4.19.0-1, remains in 4.19.0-2, and is
also in testing. This candidate carries only upstream commit
bb8d4e195275e75bd94ebeffb53cc747d357fcf4 and its two regression tests.
[ Impact ]
An application decoding untrusted, malformed BSON through decode or
decode_all can terminate when the C extension is loaded. Normal database
wire-protocol decoding does not reach this code. This is a focused
proposed update for an existing flaw in trixie, with normal maintenance
priority.
[ Tests ]
Tests completed on 18 October 2026 in a trixie amd64 chroot with
Python 3.13.5, using the built Debian packages:
- sbuild succeeded: 806 passed, 3703 skipped, 788 deselected, 2 warnings.
- The same BSON suite, including the upstream regressions, gave
83 passed, 1 failed, 1 skipped on 4.10.1-6; the candidate gave
84 passed, 0 failed, 1 pre-existing skip. Both new methods pass.
- Both C extensions were loaded from the built .deb files; their hashes
matched the package contents.
- The declared autopkgtest passed as a superficial import test (exit 8).
BSON/C regression coverage comes from the separate comparison above.
MongoDB was not used. The attached validation summary describes the
existing runs and their limits; no new test run is claimed for today.
[ Risks ]
The runtime change is confined to C BSON regular-expression decoding,
replacing unbounded scans with searches bounded by the remaining document
bytes. Regression risks are incorrect bounds handling or rejection of
valid regex values; the BSON suite covers valid data as well as the new
malformed-data cases. No external dependency or public API changes are
introduced. The four existing Debian patches are retained.
[ Checklist ]
[x] All changes are documented in debian/changelog.
[x] The complete source diff has been reviewed locally.
[x] A source debdiff against trixie 4.10.1-6 is attached.
[x] The issue is fixed in unstable.
[ Changes ]
The debdiff changes exactly three Debian files:
- debian/changelog: document CVE-2026-106435 / #1150462.
- debian/patches/00006_CVE-2026-106435.patch: upstream fix and two tests.
- debian/patches/series: enable that patch.
[ Other info ]
I maintain pymongo within the Debian Python Team and am a Debian
Maintainer. Aryan is copied for coordination; a stable uploader has not
yet been arranged.
The Security Team was contacted. On 29 October Salvatore Bonaccorso said
he was not aware of parallel work on a trixie update and suggested filing
a pu bug in coordination with the maintainer.
The attached debdiff is the tested, unsigned UNRELEASED candidate. The
changelog distribution will be set to trixie and its date finalised before
an approved upload. No upload has been made.
For the Debian Python Team: would a Salsa MR be useful for packaging
review? If so, which repository and target branch should I use?
The local work is on the separate work/trixie-1150462 branch.
Attachments: source debdiff and validation summary. Full logs and the
unsigned source package are available on request.
References:
https://bugs.debian.org/1150462
https://security-tracker.debian.org/tracker/CVE-2026-106435
https://github.com/mongodb/mongo-python-driver/commit/bb8d4e195275e75bd94ebeffb53cc747d357fcf4
Best regards,
Federico Molara