An update for mongo-c-driver is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4444 Final 1.0 1.0 2026-10-22 Initial 2026-10-22 2026-10-22 openEuler SA Tool V1.0 2026-10-22 mongo-c-driver security update An update for mongo-c-driver is now available for openEuler-22.03-LTS-SP4 mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents. Security Fix(es): An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.(CVE-2026-106428) An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size.(CVE-2026-106431) The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.(CVE-2026-106437) An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.(CVE-2026-106438) A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.(CVE-2026-88035) Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.(CVE-2026-88036) A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.(CVE-2026-93394) A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.(CVE-2026-93395) An update for mongo-c-driver is now available for openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High mongo-c-driver https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4444 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-106428 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-106431 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-106437 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-106438 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-88035 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-88036 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-93394 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-93395 https://nvd.nist.gov/vuln/detail/CVE-2026-106428 https://nvd.nist.gov/vuln/detail/CVE-2026-106431 https://nvd.nist.gov/vuln/detail/CVE-2026-106437 https://nvd.nist.gov/vuln/detail/CVE-2026-106438 https://nvd.nist.gov/vuln/detail/CVE-2026-88035 https://nvd.nist.gov/vuln/detail/CVE-2026-88036 https://nvd.nist.gov/vuln/detail/CVE-2026-93394 https://nvd.nist.gov/vuln/detail/CVE-2026-93395 openEuler-22.03-LTS-SP4 libbson-1.30.13-1.oe2203sp4.aarch64.rpm libbson-devel-1.30.13-1.oe2203sp4.aarch64.rpm mongo-c-driver-1.30.13-1.oe2203sp4.aarch64.rpm mongo-c-driver-debuginfo-1.30.13-1.oe2203sp4.aarch64.rpm mongo-c-driver-debugsource-1.30.13-1.oe2203sp4.aarch64.rpm mongo-c-driver-devel-1.30.13-1.oe2203sp4.aarch64.rpm libbson-1.30.13-1.oe2203sp4.x86_64.rpm libbson-devel-1.30.13-1.oe2203sp4.x86_64.rpm mongo-c-driver-1.30.13-1.oe2203sp4.x86_64.rpm mongo-c-driver-debuginfo-1.30.13-1.oe2203sp4.x86_64.rpm mongo-c-driver-debugsource-1.30.13-1.oe2203sp4.x86_64.rpm mongo-c-driver-devel-1.30.13-1.oe2203sp4.x86_64.rpm mongo-c-driver-1.30.13-1.oe2203sp4.src.rpm mongo-c-driver-help-1.30.13-1.oe2203sp4.noarch.rpm An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol. 2026-10-22 CVE-2026-106428 openEuler-22.03-LTS-SP4 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L mongo-c-driver security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4444 An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size. 2026-10-22 CVE-2026-106431 openEuler-22.03-LTS-SP4 Medium 5.7 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H mongo-c-driver security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4444 The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation. 2026-10-22 CVE-2026-106437 openEuler-22.03-LTS-SP4 Medium 6.2 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H mongo-c-driver security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4444 An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value. 2026-10-22 CVE-2026-106438 openEuler-22.03-LTS-SP4 Medium 4.0 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N mongo-c-driver security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4444 A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it. 2026-10-22 CVE-2026-88035 openEuler-22.03-LTS-SP4 Medium 4.7 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H mongo-c-driver security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4444 Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. 2026-10-22 CVE-2026-88036 openEuler-22.03-LTS-SP4 High 8.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H mongo-c-driver security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4444 A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments. 2026-10-22 CVE-2026-93394 openEuler-22.03-LTS-SP4 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N mongo-c-driver security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4444 A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service. 2026-10-22 CVE-2026-93395 openEuler-22.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L mongo-c-driver security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4444