Source: golang-mongodb-mongo-driver Version: 1.17.9+ds1-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi Guillem, The following vulnerability was published for golang-mongodb-mongo-driver. I'm though not completely sure if the issue is only introduce with the improved bulk Write API in v2.1.0, 50cf0c20d228975074c0010bfb688917e25934a4 or was present before. Can you please confirm? CVE-2026-81521[0]: | The MongoDB Go Driver's client-level bulk write operation may accept | a caller-supplied database name containing a reserved separator | character without escaping it before the name is used to build the | target namespace for the operation. An application that passes | untrusted input as a database name could therefore have the write | directed at a database and collection other than the ones it | intended. Only the Client.BulkWrite API is affected. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-81521 https://www.cve.org/CVERecord?id=CVE-2026-81521 Please adjust the affected versions in the BTS as needed. In fact if the hypotetis is true that is only introduced with the rewrite of the Bulk Write API then we can close this bug. Regards, Salvatore
