Release date:
2026-10-08 13:29:05 UTC
Description:
* SECURITY UPDATE: denial of service through unbounded memory use in array
and object building expressions
- debian/patches/CVE-2026-13056.patch: add the
internalQueryMaxExpressionOutputBytes limit to $array, $object,
$concatArrays, $setUnion and $zip in the classic engine and SBE
- CVE-2026-13056
* SECURITY UPDATE: denial of service in mongos through incomplete proxy
protocol headers
- debian/patches/CVE-2025-6714.patch: do not block on empty sockets when
peeking, back off between header parse attempts and time out after
120 seconds on the load balancer port
- CVE-2025-6714
* SECURITY UPDATE: denial of service through large BinData masks in bitwise
query operators
- debian/patches/CVE-2026-8199.patch: add the
internalQueryMaxBitTestIntermediatePositions limit and log large bit
position vectors in $bitsAllSet, $bitsAnySet, $bitsAllClear and
$bitsAnyClear
- CVE-2026-8199
Updated packages:
-
mongodb5_5.0.31-1+tuxcare.els16_amd64.deb
sha:918882601d651fc91f404d424f30a5b43d047965
-
mongodb5-mongos_5.0.31-1+tuxcare.els16_amd64.deb
sha:cb6b8a5c8bd442603238d96faaf8d6d36d3b5062
-
mongodb5-server_5.0.31-1+tuxcare.els16_amd64.deb
sha:bc4f95450bab4fa81e7544bf9eb7695a4af880c3
-
mongodb5-shell_5.0.31-1+tuxcare.els16_amd64.deb
sha:7a3f373d9c1fe36e665ad931d93ef18cf63675ba
-
mongodb5_5.0.31-1+tuxcare.els16_arm64.deb
sha:00c094f7694c0bb0a49c27fe55b0751a1166ec4c
-
mongodb5-mongos_5.0.31-1+tuxcare.els16_arm64.deb
sha:baf0b8b9b12cece744122b7beae31abf8815a5ba
-
mongodb5-server_5.0.31-1+tuxcare.els16_arm64.deb
sha:db85d99b038a2e658abeed3b4ab1f0f215c90b9a
-
mongodb5-shell_5.0.31-1+tuxcare.els16_arm64.deb
sha:b48a288881316d788a090ef4172a736955792525
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
