<div dir="ltr">Hey Esteban,<div><br></div><div>We greatly appreciate your rapid response throughout this process. We've updated and published the record based on your feedback above.</div><div><br></div><div>Thank you,</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Tue, Sep 29, 2026 at 1:04 PM Esteban Zimanyi <<a href="mailto:estebanzimanyi@gmail.com">estebanzimanyi@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hello,<br><br>Thank you for reserving CVE-2026-102639 and for the draft record, which is accurate. The fix is now published, and we would ask for these changes:<br><br>1. Affected versions: 1.1.0 through 1.1.2 (no fix is planned for the 1.1 series), 1.2.0 before 1.2.2, and 1.3.0 before 1.3.1. The fixed releases are 1.2.2 and 1.3.1.<br>2. References:<br> - <a href="https://github.com/MobilityDB/MobilityDB/security/advisories/GHSA-2c92-2w7c-pm3g" target="_blank">https://github.com/MobilityDB/MobilityDB/security/advisories/GHSA-2c92-2w7c-pm3g</a><br> - <a href="https://github.com/MobilityDB/MobilityDB/releases/tag/v1.3.1" target="_blank">https://github.com/MobilityDB/MobilityDB/releases/tag/v1.3.1</a><br> - <a href="https://github.com/MobilityDB/MobilityDB/releases/tag/v1.2.2" target="_blank">https://github.com/MobilityDB/MobilityDB/releases/tag/v1.2.2</a><br> - <a href="https://github.com/MobilityDB/MobilityDB/pull/2867" target="_blank">https://github.com/MobilityDB/MobilityDB/pull/2867</a><br> - <a href="https://github.com/MobilityDB/MobilityDB/pull/2865" target="_blank">https://github.com/MobilityDB/MobilityDB/pull/2865</a><br> - <a href="https://github.com/MobilityDB/MobilityDB/pull/2866" target="_blank">https://github.com/MobilityDB/MobilityDB/pull/2866</a><br>3. Title: "MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization".<br>4. Description: the same flaw also affects applications that link the MEOS library and read untrusted WKB.<br><br>Best regards,</div><div><br></div><div>Esteban</div><div><br></div><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div>------------------------------------------------------------<br>Prof. Esteban Zimanyi<br>Department of Computer & Decision Engineering (CoDE) CP 165/15 <br>Universite Libre de Bruxelles <br>Avenue F. D. Roosevelt 50 <br>B-1050 Brussels, Belgium <br>fax: <a href="tel:+32%202%20650%2047%2013" value="+3226504713" target="_blank">+ 32.2.650.47.13</a><br>tel: <a href="tel:+32%202%20650%2031%2085" value="+3226503185" target="_blank">+ 32.2.650.31.85</a><br>e-mail: <a href="mailto:esteban.zimanyi@ulb.be" target="_blank">esteban.zimanyi@ulb.be</a><br>Internet: <a href="http://cs.ulb.ac.be/members/esteban/" target="_blank">http://cs.ulb.ac.be/members/esteban/</a><br>------------------------------------------------------------</div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 29, 2026 at 5:57 PM Brandon Tarr <<a href="mailto:btarr@vulncheck.com" target="_blank">btarr@vulncheck.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hey Esteban,<br><br>We have provisionally reserved the following CVE for this vulnerability: <b>CVE-2026-102639</b>.<br><br>Credit is awarded to <b>Harsh Raj Singhania</b> as the finder.<br><br>Additionally, I've attached the proposed CVE Record to this email, please review it and let us know if anything needs to be changed.<br><br>Thank you,</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 29, 2026 at 11:37 AM Esteban Zimanyi <<a href="mailto:estebanzimanyi@gmail.com" target="_blank">estebanzimanyi@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hello,<br><br>Thank you for the report and for coordinating the disclosure.<br><br>We have reproduced the issue and confirmed the root cause described in the report. The Well-Known Binary (WKB) bounds check in meos/src/temporal/type_in.c added the requested length to the parse position, so a negative or very large length read from the input, such as the length of a text value, wrapped the pointer and passed the check. The only other guard was an assertion, which release builds compile out. With the reporter's payload, AddressSanitizer reports negative-size-param (size=-1) in text_from_wkb_state.<br><br>The fix compares every read with the bytes remaining in the buffer, rejects a negative or oversized length or count before it is used, checks that the type code in the header names a type of the expected family, and stops parsing at the first failed check, including when MEOS is used as a library with an error handler that returns. We validated it with the PostgreSQL regression suite and with sanitizer-instrumented fuzzing of the binary input functions (several million malformed inputs per branch, with no memory error in the WKB readers).<br><br>Affected versions: MobilityDB 1.1.x, 1.2.0, 1.2.1 and 1.3.0, and the development branch. We are publishing the fix today on the development branch and in patch releases of the 1.3 and 1.2 series, together with a GitHub security advisory. Please go ahead with the CVE record; could you send us the CVE ID so that we can add it to the advisory and the release notes? Please also let us know how the researcher would like to be credited.<br><br>Best regards,<br></div><div><br></div><div>Esteban</div><div><br></div><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div>------------------------------------------------------------<br>Prof. Esteban Zimanyi<br>Department of Computer & Decision Engineering (CoDE) CP 165/15 <br>Universite Libre de Bruxelles <br>Avenue F. D. Roosevelt 50 <br>B-1050 Brussels, Belgium <br>fax: <a href="tel:+32%202%20650%2047%2013" value="+3226504713" target="_blank">+ 32.2.650.47.13</a><br>tel: <a href="tel:+32%202%20650%2031%2085" value="+3226503185" target="_blank">+ 32.2.650.31.85</a><br>e-mail: <a href="mailto:esteban.zimanyi@ulb.be" target="_blank">esteban.zimanyi@ulb.be</a><br>Internet: <a href="http://cs.ulb.ac.be/members/esteban/" target="_blank">http://cs.ulb.ac.be/members/esteban/</a><br>------------------------------------------------------------</div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Sep 28, 2026 at 3:48 PM Brandon Tarr via Mobilitydb-dev <<a href="mailto:mobilitydb-dev@lists.osgeo.org" target="_blank">mobilitydb-dev@lists.osgeo.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><br clear="all"></div><div><div dir="ltr"><div><div dir="ltr"><div><p style="font-size:13px;font-variant:normal;margin:0px;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;line-height:normal;font-family:"Helvetica Neue"">Greetings MobilityDB Security Team,</p><p style="font-size:13px;font-variant:normal;margin:0px;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;line-height:normal;font-family:"Helvetica Neue""><br></p><p style="font-size:13px;font-variant:normal;margin:0px;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;line-height:normal;font-family:"Helvetica Neue"">I'm a vulnerability analyst at <a href="https://www.vulncheck.com/" target="_blank">VulnCheck</a> an exploit intelligence company and research CVE Numbering Authority (CNA), where I'm one of several folks who manage our coordinated vulnerability disclosure (CVD) program.<br><br>An external security researcher recently <a href="https://www.vulncheck.com/advisories/report" target="_blank">reported</a> a potential vulnerability impacting [<a href="https://github.com/MobilityDB/MobilityDB" target="_blank">MobilityDB / MobilityDB</a>] and VulnCheck is acting as the intermediary and coordinator.<br><br>VulnCheck follows a <a href="https://www.vulncheck.com/vulnerability-disclosure-policy" target="_blank">120-day disclosure policy</a>, meaning we afford vendors/maintainers up to 120 days from the time of receiving the report to address the issue before publication of a CVE record and third-party advisory. For this vulnerability, the 120-day deadline is <b style="font-family:Arial,Helvetica,sans-serif;font-size:small">January 26, 2027 (26/01/2027)</b>. Of note, patch publication constitutes public disclosure — if a patch is issued, we will publish the CVE record at that time rather than waiting for the full 120-day window.<br><br>The researcher has provided us with a comprehensive technical report, which we have attached to this email. Let us know if you have any questions for us about the CVD process or for the researcher regarding the reported vulnerability.</p></div></div></div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"></div></div></div></div></div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div style="color:rgb(34,34,34)"><span style="background-color:transparent">Thank you,</span></div><div style="color:rgb(34,34,34)"><span style="background-color:transparent"><br></span></div><div style="color:rgb(34,34,34)"><div dir="ltr"><div dir="ltr"><table style="border-width:medium;border-style:none;border-color:currentcolor;border-collapse:collapse"><tbody><tr><td style="border-width:1pt;border-style:solid;border-color:rgb(255,255,255);vertical-align:top;padding:5pt;overflow:hidden"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;vertical-align:baseline"><span style="border-width:medium;border-style:none;border-color:currentcolor;display:inline-block;overflow:hidden;width:49px;height:49px"><a href="https://www.vulncheck.com/" style="color:rgb(17,85,204)" target="_blank"><img src="https://lh7-us.googleusercontent.com/-9dCGnQIZaW0ehyK1B0bqLmef7d7ZWuSmmmWUYJGhzNgtzRhqFPZrtO3AnQt8PETFHiv6_YST3DacZVgrxPdAYXErAMnJrF6Isn27caszruLjby7jLRuuU__5emkqFjU8hczQ307--yVVMpVSiK7Qg" width="49" height="49" style="margin-left: 0px; margin-top: 0px;"></a></span></span></p></td><td style="border-width:1pt;border-style:solid;border-color:rgb(255,255,255);vertical-align:top;padding:5pt;overflow:hidden"><p dir="ltr" style="color:rgb(32,33,36);line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="color:rgba(0,0,0,0.847);font-family:-apple-system-font;font-size:12px">Brandon Tarr</span></p><div style="color:rgba(0,0,0,0.847);font-family:-apple-system-font;font-size:12px">VulnCheck</div></td></tr></tbody></table></div></div></div></div></div></div>
_______________________________________________<br>
Mobilitydb-dev mailing list<br>
<a href="mailto:Mobilitydb-dev@lists.osgeo.org" target="_blank">Mobilitydb-dev@lists.osgeo.org</a><br>
<a href="https://lists.osgeo.org/mailman/listinfo/mobilitydb-dev" rel="noreferrer" target="_blank">https://lists.osgeo.org/mailman/listinfo/mobilitydb-dev</a><br>
</blockquote></div>
</blockquote></div><div><br clear="all"></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div style="color:rgb(34,34,34)"><span style="background-color:transparent">Thank you,</span></div><div style="color:rgb(34,34,34)"><span style="background-color:transparent"><br></span></div><div style="color:rgb(34,34,34)"><div dir="ltr"><div dir="ltr"><table style="border-width:medium;border-style:none;border-color:currentcolor;border-collapse:collapse"><tbody><tr><td style="border-width:1pt;border-style:solid;border-color:rgb(255,255,255);vertical-align:top;padding:5pt;overflow:hidden"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;vertical-align:baseline"><span style="border-width:medium;border-style:none;border-color:currentcolor;display:inline-block;overflow:hidden;width:49px;height:49px"><a href="https://www.vulncheck.com/" style="color:rgb(17,85,204)" target="_blank"><img src="https://lh7-us.googleusercontent.com/-9dCGnQIZaW0ehyK1B0bqLmef7d7ZWuSmmmWUYJGhzNgtzRhqFPZrtO3AnQt8PETFHiv6_YST3DacZVgrxPdAYXErAMnJrF6Isn27caszruLjby7jLRuuU__5emkqFjU8hczQ307--yVVMpVSiK7Qg" width="49" height="49" style="margin-left: 0px; margin-top: 0px;"></a></span></span></p></td><td style="border-width:1pt;border-style:solid;border-color:rgb(255,255,255);vertical-align:top;padding:5pt;overflow:hidden"><p dir="ltr" style="color:rgb(32,33,36);line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="color:rgba(0,0,0,0.847);font-family:-apple-system-font;font-size:12px">Brandon Tarr</span></p><div style="color:rgba(0,0,0,0.847);font-family:-apple-system-font;font-size:12px">VulnCheck</div></td></tr></tbody></table></div></div></div></div></div>
</blockquote></div>
</blockquote></div><div><br clear="all"></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div style="color:rgb(34,34,34)"><span style="background-color:transparent">Thank you,</span></div><div style="color:rgb(34,34,34)"><span style="background-color:transparent"><br></span></div><div style="color:rgb(34,34,34)"><div dir="ltr"><div dir="ltr"><table style="border-width:medium;border-style:none;border-color:currentcolor;border-collapse:collapse"><tbody><tr><td style="border-width:1pt;border-style:solid;border-color:rgb(255,255,255);vertical-align:top;padding:5pt;overflow:hidden"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;vertical-align:baseline"><span style="border-width:medium;border-style:none;border-color:currentcolor;display:inline-block;overflow:hidden;width:49px;height:49px"><a href="https://www.vulncheck.com/" style="color:rgb(17,85,204)" target="_blank"><img src="https://lh7-us.googleusercontent.com/-9dCGnQIZaW0ehyK1B0bqLmef7d7ZWuSmmmWUYJGhzNgtzRhqFPZrtO3AnQt8PETFHiv6_YST3DacZVgrxPdAYXErAMnJrF6Isn27caszruLjby7jLRuuU__5emkqFjU8hczQ307--yVVMpVSiK7Qg" width="49" height="49" style="margin-left: 0px; margin-top: 0px;"></a></span></span></p></td><td style="border-width:1pt;border-style:solid;border-color:rgb(255,255,255);vertical-align:top;padding:5pt;overflow:hidden"><p dir="ltr" style="color:rgb(32,33,36);line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="color:rgba(0,0,0,0.847);font-family:-apple-system-font;font-size:12px">Brandon Tarr</span></p><div style="color:rgba(0,0,0,0.847);font-family:-apple-system-font;font-size:12px">VulnCheck</div></td></tr></tbody></table></div></div></div></div></div>