Back Linuxsecurity

Fedora 45 php-pecl-mongodb2 Important Out-of-Bounds Read Fix CVE-2026

Linuxsecurity •LinuxSecurity Advisories • September 13, 2026

Share: View original

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

The purpose of this driver is to provide exceptionally thin glue between

MongoDB and PHP, implementing only fundemental and performance-critical

components necessary to build a fully-functional MongoDB driver.

Version 2.5.2 PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in #2081 CVE-2026-84968 Version 2.5.0 Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying. Version 2.4.1 PHPC-2742: Bump libmongocrypt to 1.20.2 by @GromNaN in PHPC-2755: Fix test suite failures with PHP 8.6 by @GromNaN in PHPC-2745: Reject null bytes in namespaces and periods in database names [v2.4] by @GromNaN in PHPC-2745: Reject null bytes in namespaces and periods in database names [v1.21] by @GromNaN in

* Fri Sep 4 2026 Remi Collet - 2.5.2-1 - update to 2.5.2 - raise dependency on libmongoc 2.5.2 and libmongocrypt 1.20.4 * Thu Sep 3 2026 Remi Collet - 2.5.0-1 - update to 2.5.0 - raise dependency on libmongoc 2.5.1 and libmongocrypt 1.20.3 * Tue Sep 1 2026 Remi Collet - 2.4.1-1 - update to 2.4.1 - raise dependency on libmongocrypt 1.20.2

Fedora Update Notification FEDORA-2026-1576c48cce 2026-09-13 00:15:52.527852+00:00 Name : php-pecl-mongodb2 Product : Fedora 45 Version : 2.5.2 Release : 1.fc45 URL : Summary : MongoDB driver for PHP version 2 Description : The purpose of this driver is to provide exceptionally thin glue between MongoDB and PHP, implementing only fundemental and performance-critical components necessary to build a fully-functional MongoDB driver.

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-1576c48cce' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in MongoDB Drivers Affect Fedora Users Recent updates for Fedora 45 and earlier versions address critical vulnerabilities in MongoDB drivers. The php-pecl-mongodb2 and mongo-c-driver libraries have multiple CVEs, including CVE-2026-84964, CVE-2026-84965, CVE-2026-84968, CVE-2026-84969, and CVE-2026-84963, all published on September 3, 2026. These vulnerabilities include issues like out-of-bounds reads, unsafe casts, and OCSP parsing errors, which could lead to remote code execution or denial of service. Affected systems include Fedora 43, 44, and 45. Users are advised to update their systems immediately using the provided DNF commands. The updates were released on September 13, 2026, following the discovery of these vulnerabilities. The severity of these issues necessitates prompt action from system administrators. 7 sources 61

Extracted Entities

CVEs (1)

CVE-2026-84968

CWE Weaknesses (1)

CWE-125 - Out-of-bounds Read