mongo-c-driver security update

{
  "id": "3b44fe9cf4f756c3cb0b02c1b6e30ecab9a5fd37d943059ecd760d41fdda18e1",
  "url": "https://osv.dev/vulnerability/OESA-2026-4352",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "mongo-c-driver security update",
    "summary": "mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents. Security Fix(es): A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.(CVE-2026-81524) An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.(CVE-2026-84963) A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting clien",
    "evidence": "osv:OESA-2026-4352",
    "products": [
      {
        "name": {
          "value": "mongo-c-driver",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.30.9-1.oe2203sp4",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "OESA-2026-4352",
      "aliases": [
        "OESA-2026-4352"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.30.9-1.oe2203sp4"
                }
              ]
            }
          ],
          "package": {
            "name": "mongo-c-driver",
            "purl": "pkg:rpm/openEuler/mongo-c-driver&distro=openEuler-22.03-LTS-SP4",
            "ecosystem": "openEuler:22.03-LTS-SP4"
          },
          "database_specific": {
            "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4352.json"
          },
          "ecosystem_specific": {
            "src": [
              "mongo-c-driver-1.30.9-1.oe2203sp4.src.rpm"
            ],
            "noarch": [
              "mongo-c-driver-help-1.30.9-1.oe2203sp4.noarch.rpm"
            ],
            "x86_64": [
              "libbson-1.30.9-1.oe2203sp4.x86_64.rpm",
              "libbson-devel-1.30.9-1.oe2203sp4.x86_64.rpm",
              "mongo-c-driver-1.30.9-1.oe2203sp4.x86_64.rpm",
              "mongo-c-driver-debuginfo-1.30.9-1.oe2203sp4.x86_64.rpm",
              "mongo-c-driver-debugsource-1.30.9-1.oe2203sp4.x86_64.rpm",
              "mongo-c-driver-devel-1.30.9-1.oe2203sp4.x86_64.rpm"
            ],
            "aarch64": [
              "libbson-1.30.9-1.oe2203sp4.aarch64.rpm",
              "libbson-devel-1.30.9-1.oe2203sp4.aarch64.rpm",
              "mongo-c-driver-1.30.9-1.oe2203sp4.aarch64.rpm",
              "mongo-c-driver-debuginfo-1.30.9-1.oe2203sp4.aarch64.rpm",
              "mongo-c-driver-debugsource-1.30.9-1.oe2203sp4.aarch64.rpm",
              "mongo-c-driver-devel-1.30.9-1.oe2203sp4.aarch64.rpm"
            ]
          }
        }
      ],
      "modified": "2026-10-16T12:15:10.981751880Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-81524",
        "CVE-2026-84963",
        "CVE-2026-84964",
        "CVE-2026-84965",
        "CVE-2026-84969"
      ],
      "references": [
        "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4352",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-81524",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84963",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84964",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84965",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84969"
      ],
      "provider_metadata": {
        "severity": "Medium"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-81524",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-84963",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-84964",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-84965",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-84969",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 340821,
  "published_at": "2026-10-16T11:59:40+00:00"
}