ALAS2027-2026-184

References: CVE-2026-96748  CVE-2026-96749  CVE-2026-96747 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-96749:
A flaw was found in pymongo. An integer overflow exists in the bundled native extension for Binary JSON (BSON) document encoding when processing an unusually large amount of data. An unprivileged attacker who can submit oversized data to an application for encoding can trigger an arithmetic overflow, resulting in a write outside the boundaries of an allocated memory buffer. This issue can lead to arbitrary code execution within the application process or a denial of service (DoS) via an application crash.

CVE-2026-96748:
A flaw was found in pymongo. The driver improperly decodes percent-encoded characters in connection strings before separating host entries on delimiters. If an application incorporates untrusted hostnames into its connection strings, a remote attacker can inject arbitrary servers into the database client configuration. As a result, the application may connect to an attacker-controlled server, leading to data tampering and information disclosure.

CVE-2026-96747:
A flaw was found in pymongo. When client-side field-level encryption is configured, the driver misinterprets Key Management Service (KMS) endpoint addresses ending in '.sock' as local Unix domain socket files rather than remote network hosts. An authenticated database user with permission to modify encryption key metadata can exploit this behavior to force the application into opening connections to local sockets on the host system. While data transmitted across these connections is limited to an initial Transport Layer Security (TLS) handshake, it may trigger unintended interactions with local services running on the application server.

Issue Correction:
Run dnf update python-pymongo or dnf update --advisory ALAS2027-2026-184 to update your system.

New Packages:

aarch64:
    python-pymongo-debugsource-4.18.2-1.amzn2027.0.1.aarch64
    python3-bson-debuginfo-4.18.2-1.amzn2027.0.1.aarch64
    python3-bson-4.18.2-1.amzn2027.0.1.aarch64
    python-pymongo-debuginfo-4.18.2-1.amzn2027.0.1.aarch64
    python3-pymongo-debuginfo-4.18.2-1.amzn2027.0.1.aarch64
    python3-pymongo-4.18.2-1.amzn2027.0.1.aarch64
    python3-pymongo-gridfs-4.18.2-1.amzn2027.0.1.aarch64

noarch:
    python-pymongo-doc-4.18.2-1.amzn2027.0.1.noarch

src:
    python-pymongo-4.18.2-1.amzn2027.0.1.src

x86_64:
    python3-pymongo-gridfs-4.18.2-1.amzn2027.0.1.x86_64
    python-pymongo-debugsource-4.18.2-1.amzn2027.0.1.x86_64
    python3-bson-debuginfo-4.18.2-1.amzn2027.0.1.x86_64
    python-pymongo-debuginfo-4.18.2-1.amzn2027.0.1.x86_64
    python3-bson-4.18.2-1.amzn2027.0.1.x86_64
    python3-pymongo-debuginfo-4.18.2-1.amzn2027.0.1.x86_64
    python3-pymongo-4.18.2-1.amzn2027.0.1.x86_64