Bug 2542961

Summary: CVE-2026-96748 python-pdfminer: pymongo: Database connection redirection via percent-encoded host delimiter injection [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Ganesh <gnaik>
Component: python-pdfminerAssignee: Ben Beasley <code>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: epel10CC: code, python-packagers-sig
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["1905b6b3-b961-4ae7-83f8-63ecfe00bd98"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-29 06:56:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2540685    

Description Ganesh 2026-09-29 06:16:16 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.
Comment 1 Ben Beasley 2026-09-29 06:56:22 UTC 
The python-pdfminer package contains only pymongo code derived from pymongo/saslprep.py, which doesn’t contain the affected percent-decoding and connection string parsing code.