Hi, On Sat, Oct 31, 2026 at 09:46:17PM +0100, Federico Molara wrote: > Package: release.debian.org > Severity: normal > Tags: trixie > User: [email protected] > Usertags: pu > X-Debbugs-Cc: [email protected] > Control: affects -1 + src:pymongo > > Dear Release Team, > > Please consider pymongo 4.10.1-6+deb13u1 for the next trixie point release. > I am requesting pre-approval before arranging an upload. > > [ Reason ] > Backport the upstream fix for CVE-2026-106435 / #1150462 (severity > important). Trixie 4.10.1-6 contains unbounded regular-expression scans > in the native BSON decoder. The Security Tracker marks this no-dsa.
FWIW, there are more CVEs marked as no-dsa, so maybe include those as well in the batch of updates for pymongo via the the next point release. Regards, Salvatore
