Release date:
2026-10-08 23:10:58 UTC
Description:
* SECURITY UPDATE: denial of service through unbounded memory use in array
and object building expressions
- debian/patches/CVE-2026-13056.patch: add the
internalQueryMaxExpressionOutputBytes limit to $array, $object,
$concatArrays, $setUnion and $zip in the classic engine and SBE
- CVE-2026-13056
* SECURITY UPDATE: denial of service in mongos through incomplete proxy
protocol headers
- debian/patches/CVE-2025-6714.patch: do not block on empty sockets when
peeking, back off between header parse attempts and time out after
120 seconds on the load balancer port
- CVE-2025-6714
* SECURITY UPDATE: denial of service through large BinData masks in bitwise
query operators
- debian/patches/CVE-2026-8199.patch: add the
internalQueryMaxBitTestIntermediatePositions limit and log large bit
position vectors in $bitsAllSet, $bitsAnySet, $bitsAllClear and
$bitsAnyClear
- CVE-2026-8199
Updated packages:
-
mongodb5_5.0.31-1+tuxcare.els16_amd64.deb
sha:918882601d651fc91f404d424f30a5b43d047965
-
mongodb5-mongos_5.0.31-1+tuxcare.els16_amd64.deb
sha:c7aad084263eae4b1758ed7a2a39619733842496
-
mongodb5-server_5.0.31-1+tuxcare.els16_amd64.deb
sha:cae04542f43e09a1dbecfaad6f2b61e405cff8cd
-
mongodb5-shell_5.0.31-1+tuxcare.els16_amd64.deb
sha:2f66e9f5b1df60d19ede2852234ff23ee9afe8dd
-
mongodb5_5.0.31-1+tuxcare.els16_arm64.deb
sha:00c094f7694c0bb0a49c27fe55b0751a1166ec4c
-
mongodb5-mongos_5.0.31-1+tuxcare.els16_arm64.deb
sha:78a95e9a54323ed67c6ba09995282babab301f90
-
mongodb5-server_5.0.31-1+tuxcare.els16_arm64.deb
sha:be48ee88cac7a942c583b2f6cc4cee301e44d58c
-
mongodb5-shell_5.0.31-1+tuxcare.els16_arm64.deb
sha:92c0fe30fdca3b053520ffda899187a68b27327f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
