[GHSA-x43h-8pfv-xx24] Improve advisory details: reference incomplete fix for CVE-2024-6383

[decsecre583]

Proposed Change

Add cross-reference between CVE-2024-6383 and CVE-2025-0755 to document the incomplete fix relationship.

Evidence

• CVE-2024-6383 fix (commit 7c34461) patches bson_string_append for buffer overflow
• CVE-2025-0755 advisory states: "the various bson_append functions... may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX)"
• Both target the same bson_append/bson_string_append buffer management code
• CVE-2025-0755 tracked in CDRIVER-5601: same JIRA project as the original fix
• Same CWE (buffer overflow), same component (libbson), same root cause (size tracking during append)

[JonathanLEvans]

Hi @decsecre583,

Thank you for your contribution. However, I am unable to find MongoDB C Driver in one of our supported ecosystems. Could you provide a link to where you found it in one of the package systems?

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.