Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96749: A flaw was found in pymongo. An integer overflow exists in the bundled native extension for Binary JSON (BSON) document encoding when processing an unusually large amount of data. An unprivileged attacker who can submit oversized data to an application for encoding can trigger an arithmetic overflow, resulting in a write outside the boundaries of an allocated memory buffer. This issue can lead to arbitrary code execution within the application process or a denial of service (DoS) via an application crash.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | python-pymongo-debuginfo | 0:3.10.1-5.amzn2023.0.5 |
| Amazon Linux · 2023 | python-pymongo-debugsource | 0:3.10.1-5.amzn2023.0.5 |
| Amazon Linux · 2023 | python-pymongo-doc | 0:3.10.1-5.amzn2023.0.5 |
| Amazon Linux · 2023 | python3-bson | 0:3.10.1-5.amzn2023.0.5 |
| Amazon Linux · 2023 | python3-bson-debuginfo | 0:3.10.1-5.amzn2023.0.5 |
| Amazon Linux · 2023 | python3-pymongo | 0:3.10.1-5.amzn2023.0.5 |
| Amazon Linux · 2023 | python3-pymongo-debuginfo | 0:3.10.1-5.amzn2023.0.5 |
| Amazon Linux · 2023 | python3-pymongo-gridfs | 0:3.10.1-5.amzn2023.0.5 |
Vulnerabilities 1
-
High 8.4
Heap out-of-bounds write via signed size overflow in BSON document encoding
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-b…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-96749.html