-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Nov 2026 15:28:53 -0500
Source: libmongocrypt
Architecture: source
Version: 1.13.2-1+deb13u2
Distribution: trixie
Urgency: medium
Maintainer: Mongo C Driver Team <mongo-c-driver-debian@googlegroups.com>
Changed-By: Roberto C. Sanchez <roberto@connexer.com>
Changes:
 libmongocrypt (1.13.2-1+deb13u2) trixie; urgency=medium
 .
   * Fix CVE-2026-84962: authenticated KMS request forgery via CRLF injection
     in GCP key identifier strings
   * Fix CVE-2026-84971: reject undersized ciphertext before allocating
     plaintext
   * Fix CVE-2026-106429: application denial of service via malformed KMS
     endpoint
   * Fix CVE-2026-106434: unrecognized payload acceptance in explicit decryption
   * Fix CVE-2026-106433: heap corruption via duplicate masterKey fields
   * Fix CVE-2026-114655: KMS request injection via unsanitized key vault and
     provider values
Checksums-Sha1:
 fc79dc83d53fdd98daae13afd0a724516a0b8940 2226 libmongocrypt_1.13.2-1+deb13u2.dsc
 1f024f6ab9648e927f499941c8e07f312f6c546c 27004 libmongocrypt_1.13.2-1+deb13u2.debian.tar.xz
 63332aa825fefa0601235dbe21ad35e27489b7c1 7029 libmongocrypt_1.13.2-1+deb13u2_source.buildinfo
Checksums-Sha256:
 84bba5004c67dd90816365be988e5531e4a2656cff5432e35882a9567b19b8bd 2226 libmongocrypt_1.13.2-1+deb13u2.dsc
 af3434072ea2d6b69b40524a55d56dc484864c2e2cff56930f35e3d82844348a 27004 libmongocrypt_1.13.2-1+deb13u2.debian.tar.xz
 273a05526f9b971c97dc697e34f9492c54d65b7201b372d94d5e2a2540143291 7029 libmongocrypt_1.13.2-1+deb13u2_source.buildinfo
Files:
 dbe3373f974e75463afa1281be66a53f 2226 libs optional libmongocrypt_1.13.2-1+deb13u2.dsc
 04c21f69cd45978c6d6f5b58e68ce014 27004 libs optional libmongocrypt_1.13.2-1+deb13u2.debian.tar.xz
 231f01d6bfce1b943a74762b91b91073 7029 libs optional libmongocrypt_1.13.2-1+deb13u2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEIYZ1DR4ae5UL01q7ldFmTdL1kUIFAmrqWi4ACgkQldFmTdL1
kUJ6qRAArwQFIv8aE5lpRS+RxFwJbEvVMitk8MlEZfRu/uHLB+b9vJdAVAjUO40Y
f1J92uQq22sHqlo1e+vFr5GbmEDS77ojCyL1R4si8yHB06a82EftWuJbhI/5YGdX
ojZLHTP0DxjHb5pssXIZoDRGJZzLvm0DBu513UR7If5TVkwgSpHkDVCHu9PrV2Ig
CFBNpNrqXEphcSPUjLiCbLg/A+7b38kd/aXLMRsLTmP0lPhLliAAjI6HInVOga8B
ATeWChFv1PVV7TG01kPEALcHNI64+BBxj65s/2zcu2QHLu+dp2ZXBBKClnUcgiww
L7XfoI9THHedZhsVgKzATfn0bU+O2le9bOwCJMXzhfilb5yZwhKUm/dAjM05iJI2
465xxM+Uz6EZIzrSUY61pgksDn70jEJG+0ExTMaH6ehuNyro4uI70eQzhkEjtH9/
0b1DwNlzHfdT6TrZoy63ooWgeeol6YTtpiIUY3CNJsC/ELPPAh8ZUiMvuA/jY7TN
1EbSDvyMKXKlopN3w+27wb1nIrzeqde6UP9gGci8uDxNYFn3QidrxLlExh3bePCB
W3pNH9ZRpBjEoYAD+eIvNFOUhjpiGur3VwyDaV8A1vbs3OxLCn1Ixa6fJkY2NhWa
WT/gX5qe5W+wXz7vfkAlBzuONu8iiPiBYe3jxUXYRu0dti7FB/Y=
=Xj6V
-----END PGP SIGNATURE-----