Repository navigation
Update dependency pymongo to v4.18.3 [SECURITY] - #110
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #110 +/- ##
==========================================
+ Coverage 85.71% 88.39% +2.67%
==========================================
Files 5 5
Lines 112 112
==========================================
+ Hits 96 99 +3
+ Misses 16 13 -3 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.7.2→4.18.3MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element
CVE-2026-106435 / GHSA-98qm-wvgf-w4cf
More information
Details
Impact
The C extension's BSON decoder scans a Regex element's pattern and flags strings with strlen before checking the document's remaining length, so a crafted truncated Regex element can read past the end of the caller's buffer. bson.decode and bson.decode_all accept mmap and array buffers, which carry no NUL sentinel; the read can cross into unmapped memory and kill the process with an uncatchable SIGSEGV. Any application decoding untrusted BSON from such buffers is affected — impact is availability only, since the out-of-bounds bytes are never returned as content. NUL-terminated buffers (bytes, bytearray) raise
InvalidBSONat worst; the driver's own transport and pure-Python installs are not affected. All releases through 4.18.2 are affected when the C extension is loaded.Patches
Fixed in PyMongo 4.18.3. Malformed Regex elements now raise InvalidBSON on every accepted buffer type; valid documents decode unchanged.
Workarounds
Decode untrusted BSON only from NUL-terminated buffers — bytes or bytearray — and copy mmap input first, e.g. bytes(mm[:size]).
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
mongodb/mongo-python-driver (pymongo)
v4.18.3: PyMongo 4.18.3Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-3-released/344145
CVE-2026-106435
v4.18.2: PyMongo 4.18.2Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732
CVE-2026-96749
CVE-2026-96748
CVE-2026-96747
v4.18.1: PyMongo 4.18.1Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338
v4.18.0: PyMongo 4.18.0Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137
v4.17.0: PyMongo 4.17.0Compare Source
Community notes
What's Changed
New Contributors
Full Changelog: mongodb/mongo-python-driver@4.16.0...4.17.0
v4.16.0: PyMongo 4.16.0Compare Source
Community notes:
v4.15.5: PyMongo 4.15.5Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-15-5-released/332185
v4.15.4: PyMongo 4.15.4Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-15-4-released/331292
v4.15.3: PyMongo 4.15.3Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-15-3-released/329778
v4.15.2: PyMongo 4.15.2Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-15-2-released/329543
v4.15.1: PyMongo 4.15.1Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-15-1-released/328837
v4.15.0: PyMongo 4.15.0Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-15-released/328574
v4.14.1: PyMongo 4.14.1Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-14-1-released/327511
v4.14.0: PyMongo 4.14.0Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-14-released/326906
v4.13.2: PyMongo 4.13.2Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-13-2-released/323705
v4.13.1: PyMongo 4.13.1Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-13-1-released/323356
v4.13.0: PyMongo 4.13.0Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-13-0-released/321391.
v4.12.1: PyMongo 4.12.1Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-12-1-released/320326
What's Changed
Full Changelog: mongodb/mongo-python-driver@4.12.0...4.12.1
v4.12.0: PyMongo 4.12.0Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-12-released/318187
v4.11.3: PyMongo 4.11.3Compare Source
What's Changed
New Contributors
Full Changelog: mongodb/mongo-python-driver@4.11.2...4.11.3
v4.11.2: PyMongo 4.11.2Compare Source
Community notes:
What's Changed
Full Changelog: mongodb/mongo-python-driver@4.11.1...4.11.2
v4.11.1: PyMongo 4.11.1Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-11-1-released/312193
v4.11: PyMongo 4.11.0Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-11-released/310976
v4.10.1: PyMongo 4.10.1Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-10-1-released/299573
v4.10.0: PyMongo 4.10.0Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-10-0-released/299474
v4.9.2: PyMongo 4.9.2Compare Source
pymongo.asynchronous.mongo_client.AsyncMongoClientcould deadlock.pymongo.results.UpdateResult.did_upsertwould raise a TypeError.v4.9.1: PyMongo 4.9.1Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-9-released/297833
v4.9Compare Source
v4.8.0: PyMongo 4.8.0Compare Source
Changes in Version 4.8.0
PyMongo 4.8 brings a number of improvements including:
bson.binary.Binaryis now redacted when the subtype is SENSITIVE_SUBTYPE(8).GitHub Releases now include a Software Bill of Materials, and signature
files corresponding to the distribution files released on PyPI.
startAtOperationTimeandresumeTokencould be added to a retry attempt, which caused the retry to fail.
sslmodule whenpyopensslimport fails with AttributeError.Unavoidable breaking changes
hatchas our build backend, we no longer have a usablesetup.pyfileand require installation using
pip. Attempts to invoke thesetup.pyfile will raise an exception.Additionally,
pip>= 21.3 is now required for editable installs.Issues Resolved
See the PyMongo 4.8 release notes in JIRA for the list of resolved issues in this release.
Full Changelog: mongodb/mongo-python-driver@4.7.1...4.8.0
v4.7.3: PyMongo 4.7.3Compare Source
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-7-3-released/283508
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.