Release date:
2026-10-09 16:25:45 UTC
Description:
* SECURITY UPDATE: Denial of service through very large intermediate arrays
and objects built by aggregation expressions
- debian/patches/CVE-2026-13056.patch: add the
internalQueryMaxExpressionOutputBytes limit and enforce it in $array,
$object, $concatArrays, $setUnion and $zip
- CVE-2026-13056
* SECURITY UPDATE: Crash or incorrect results when user fields collide with
internal metadata field names
- debian/patches/CVE-2026-9750.patch: skip lazy metadata loading for
documents without system-injected metadata, hide metadata-named user
fields and strip them when serializing documents with metadata
- CVE-2026-9750
Updated packages:
-
mongodb44_4.4.29-1+tuxcare.els18_amd64.deb
sha:c29a45c66324629e995336acf2960951a91c5c53
-
mongodb44-mongos_4.4.29-1+tuxcare.els18_amd64.deb
sha:8efeb9f03d1ebeab45a034853280b399635d4856
-
mongodb44-server_4.4.29-1+tuxcare.els18_amd64.deb
sha:261ee037e3f30da903944dd15fc4ef0d2aca1459
-
mongodb44-shell_4.4.29-1+tuxcare.els18_amd64.deb
sha:cbfeeb360c9fe3d9156859f91ec4d225a9d6d8ae
-
mongodb44_4.4.29-1+tuxcare.els18_arm64.deb
sha:a4c6a917bad743cc17aceaf6cf2c3626072b5dd0
-
mongodb44-mongos_4.4.29-1+tuxcare.els18_arm64.deb
sha:67b436a4b43f052f45b7abb2ec74058149b20808
-
mongodb44-server_4.4.29-1+tuxcare.els18_arm64.deb
sha:d91425b5f4f81073442fadf9a170ad1983214786
-
mongodb44-shell_4.4.29-1+tuxcare.els18_arm64.deb
sha:20b20b64cb0acc459b267d94d053b28773e21bb9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
