Announcing 2.5.3 of libbson and libmongoc, the libraries constituting the MongoDB C Driver.

libbson

No changes since 2.5.2. Version incremented to match the libmongoc version.

libmongoc

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

Links:

• All the issues resolved in 2.5.3
• Documentation

Thanks to everyone who contributed to this release.

• Connor MacDonald
• Kevin Albertson

Announcing 1.30.10 of libbson and libmongoc, the libraries constituting the MongoDB C Driver.

libbson

No changes since 1.30.9. Version incremented to match the libmongoc version.

libmongoc

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

Links:

• All the issues resolved in 1.30.10
• Documentation

Thanks to everyone who contributed to this release.

• Connor MacDonald
• Kevin Albertson

Announcing 2.5.2 of libbson and libmongoc, the libraries constituting the MongoDB C Driver.

libbson

No changes since 2.5.1. Version incremented to match the libmongoc version.

libmongoc

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

Links:

• All the issues resolved in 2.5.2
• Documentation

Announcing 1.30.9 of libbson and libmongoc, the libraries constituting the MongoDB C Driver.

libbson

No changes since 1.30.8. Version incremented to match the libmongoc version.

libmongoc

Fixes

• Fix OCSP error handling. CVE-2026-84964
• Fix unsafe casts during JSON parsing. CVE-2026-84965
• Fix possible unsafe truncation when logging base64. CVE-2026-84969
• Fix unsafe calls to bson_next_power_of_two. CVE-2026-84963

Links:

• All the issues resolved in 1.30.9
• Documentation

Announcing 2.5.1 of libbson and libmongoc, the libraries constituting the MongoDB C Driver.

libbson

No changes since 2.5.1. Version incremented to match the libmongoc version.

libmongoc

Fixes

• Validate database and collection name arguments against "." and NUL bytes (CVE-2026-81524)

Links:

• All the issues resolved in 2.5.1
• Documentation

Thanks to everyone who contributed to this release.

• Kevin Albertson

Announcing 2.5.0 of libbson and libmongoc, the libraries constituting the MongoDB C Driver.

libbson

No changes since 2.4.0. Version incremented to match the libmongoc version.

libmongoc

New Features

• Honor the server-supplied baseBackoffMS on responses labeled SystemOverloadedError, using it in place of the driver's default base delay when calculating how long to wait before retrying.
• Add collection bulk write getters.

Improvements

• Update bundled utf8proc to 2.11.3.

Links:

• All the issues resolved in 2.5.0
• Documentation

Thanks to everyone who contributed to this release.

• Kevin Albertson
• Christian Schmitz
• Connor MacDonald
• dfengliu

Announcing 2.4.0 of libbson and libmongoc, the libraries constituting the MongoDB C Driver.

libbson

No changes since 2.3.3. Version incremented to match the libmongoc version.

libmongoc

Notes

• Raise required version of libmongocrypt from 1.15.1 to 1.20.0 to support In-Use Encryption (corresponds to the CMake option: ENABLE_CLIENT_SIDE_ENCRYPTION).
• In a future minor release the minimum supported MongoDB Server version will be raised from 4.2 to 4.4. This is in accordance with MongoDB Software Lifecycle Schedules.

Deprecations

• The Queryable Encryption "Text" APIs are deprecated for "String" APIs
  • mongoc_client_encryption_encrypt_text_* is deprecated for mongoc_client_encryption_encrypt_string_* to match the generally available "String" algorithm.
  • The TextPreview algorithm is deprecated. Use String instead.

New Features

• The Queryable Encryption "String" algorithm (MONGOC_ENCRYPT_ALGORITHM_STRING) is now generally available, supporting prefix, suffix, and substring query types.
  • The prefixPreview, suffixPreview, and substringPreview query types remains experimental.
• Snapshot sessions expose APIs to get and set snapshot times.
• Support AWS STS regional endpoints.

Fixes

• Fix handling of verbose results in bulkWrite replies.
• Fix handling of SCRAM replies.

Links:

• All the issues resolved in 2.4.0
• Documentation

Thanks to everyone who contributed to this release.

• Kevin Albertson
• Ezra Chung
• Colby Pike
• Connor MacDonald
• Adrian Dole
• bvalente

Announcing 2.3.3 of libbson and libmongoc, the libraries constituting the MongoDB C Driver.

libbson

No changes since 2.3.3. Version incremented to match the libmongoc version.

libmongoc

Fixes

• Fix error configuring with CMake 4.4.0.
• Fix issues when built with UNICODE on Windows.
• Add stricter validation to HTTP handling.

Links:

• All the issues resolved in 2.3.3
• Documentation

Thanks to everyone who contributed to this release.

• Kevin Albertson
• Colby Pike

Announcing 2.3.2 of libbson and libmongoc, the libraries constituting the MongoDB C Driver.

libbson

No changes since 2.3.2. Version incremented to match the libmongoc version.

libmongoc

Fixes

• Fix possible abort on failed killCursors (introduced in 2.3.0).
• Fix error handling in SCRAM authentication.

Links:

• All the issues resolved in 2.3.2
• Documentation

Thanks to everyone who contributed to this release.

• Connor MacDonald
• Ezra Chung
• Kevin Albertson

Announcing 2.3.1 of libbson and libmongoc, the libraries constituting the MongoDB C Driver.

libbson

Fixes

• Fix length check in bson_new_from_buffer.
• Fix documentation generation on Sphinx 9.0+.

libmongoc

Improvements

• Improve forward compatibility with OpenSSL 4.0.0 when handling EAGAIN errors in old-style read callbacks where BIO_FLAGS_AUTO_EOF is enabled.
• Improve decompressed message length constraints.

Fixes

• Fix documentation generation on Sphinx 9.0+.
• Propagate username to custom OIDC callback.

Links:

• All the issues resolved in 2.3.1
• Documentation

Thanks to everyone who contributed to this release.

• Ezra Chung
• Colby Pike
• Kevin Albertson