[GHSA-x43h-8pfv-xx24] Improve advisory details: reference incomplete fix for CVE-2024-6383

[decsecre583]

Proposed Change

Add cross-reference between CVE-2024-6383 and CVE-2025-0755 to document the incomplete fix relationship.

Evidence

• CVE-2024-6383 fix (commit 7c34461) patches bson_string_append for buffer overflow
• CVE-2025-0755 advisory states: "the various bson_append functions... may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX)"
• Both target the same bson_append/bson_string_append buffer management code
• CVE-2025-0755 tracked in CDRIVER-5601: same JIRA project as the original fix
• Same CWE (buffer overflow), same component (libbson), same root cause (size tracking during append)

[JonathanLEvans]

Hi @decsecre583,

Thank you for your contribution. However, I am unable to find MongoDB C Driver in one of our supported ecosystems. Could you provide a link to where you found it in one of the package systems?