-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 25 Oct 2026 19:36:57 +0100
Source: php-mongodb
Binary: php-mongodb php-mongodb-all-dev
Architecture: all
Version: 2.0.0-1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) <buildd_amd64-x86-conova-01@buildd.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Description:
 php-mongodb - MongoDB driver for PHP
 php-mongodb-all-dev - MongoDB driver for PHP
Changes:
 php-mongodb (2.0.0-1+deb13u2) trixie-security; urgency=high
 .
   * Backported from 2.1.11:
    + [CVE-2026-106432]: Bound-check string and binary lengths in BSON
      encoder
    + [CVE-2026-106436]: Check libbson append return values in BSON encoder
   * Backported from 2.1.12:
    + [CVE-2026-112368]: Prevent stack exhaustion when decoding deeply
      nested BSON
Checksums-Sha1:
 dd316fc0cfa50a5a0669358835ea6792e376cb51 7460 php-mongodb-all-dev_2.0.0-1+deb13u2_all.deb
 b8ef6893bd4f986a504367e177d90665ef01ebb2 7525 php-mongodb_2.0.0-1+deb13u2_all-buildd.buildinfo
 6c4e1e203b86d3fcce42069f16f347e35111ccea 7436 php-mongodb_2.0.0-1+deb13u2_all.deb
Checksums-Sha256:
 fb114fdaa143b2f7f1a0c701c96d3c1876fe906f9050732da7cad1e8ce2fc564 7460 php-mongodb-all-dev_2.0.0-1+deb13u2_all.deb
 ac57a05dfda9f1efeb6f3e2185c98f558d7e3f819b01b784025e16040c9816b4 7525 php-mongodb_2.0.0-1+deb13u2_all-buildd.buildinfo
 8b22d0532bec8009e82e8008714bac0fb6175128a586605632147bb1ce4c9389 7436 php-mongodb_2.0.0-1+deb13u2_all.deb
Files:
 e8f31ba4d312c892d83e696b445a7db4 7460 php optional php-mongodb-all-dev_2.0.0-1+deb13u2_all.deb
 c088ab0710710107bdc78a1f1ad9ff6b 7525 php optional php-mongodb_2.0.0-1+deb13u2_all-buildd.buildinfo
 ce1225e3cdfea63ed8f9003ea23d1ae0 7436 php optional php-mongodb_2.0.0-1+deb13u2_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmreVDYACgkQPkCWRKsh
20cQIw/+LrfoKqZi4073TnKcxLIc22qbh/yhNkMuBqImzfKXwCscSD8sgAyxhl8h
RPQXIRjo8B4sZF+s7lW67EamAzj1bAtEIAD9xZVb7fhuJUzTAi0UUmICW0QvoVoJ
2LEpOnUQLkyqXrCuUm+dOjYpx1pXOiNcIBh1ULPTokDGrzqCgbLw/sD0uu2+bmuH
f0YLUfFQb1RsWn5/123OEY2cDaMcyFYjfUHAAk38UaTLC6Nn22xcLjyLh2RLizwj
DOodFEwGdO4BrJQ5X+LOUMgiT1QAE6N3gxOvG+YqhbDG8T0No0YVlNQTBIVLMKjL
ZSFvekGaIq6W4t+ckoi2mnztrF303AbeiXtmnx/wCrgv0eh13ax7EUABGbnab75s
MCCvvSZijo+YoR0XCXoEXmoYD8xYuxjCcV92hJqjKiy8MsicDWBgTaUkkJuOE2IU
t8EphBfAEQWcOHc6/Nl0HDjdAFB5b5Jbek224Ktebwr89puEqNWQB1RQhqzRo9W0
uELHSKK2fXrw70F8bB6xppvjGCZjN/Bcok8/Z1oXKe7NlXlMLO22ketYDWhTDPj3
cVohSMnblpOCksLLPI1SVA0+suDgCRe/e5hdwC7qJIxUcLU5mGYaVaEPrTePLnof
rhqt+r7SF/x7XZLa6bdXBSCEkFqi7MTOSvaDO2eXv0/XFniYUvw=
=tKiX
-----END PGP SIGNATURE-----