Yesterday, we noticed that mongodb v8.0.31 has been retracted from the Debian community repo which got published there on August 24th.

$ mongod --version
db version v8.0.31
Build Info: {
    "version": "8.0.31",
    "gitVersion": "0182ebeb7e37d46f7d40717bab701f1a30d2746f",
    "openSSLVersion": "OpenSSL 3.5.7 9 Jun 2026",
    "modules": [],
    "allocator": "tcmalloc-google",
    "environment": {
        "distmod": "debian12",
        "distarch": "x86_64",
        "target_arch": "x86_64"
    }
}

As with all mongodb versions, the gitVersion hash cannot be found in any public repositories, so we have no way to find any changes related to this release. The current stable release of mongodb is v8.0.29, with v8.0.30 being in preparation.

We only found two references to v8.0.31:

• https://jira.mongodb.org/browse/WT-18353 and
• https://qiita.com/Keiji_otsubo/items/434794eda69f87995f0b

both explicitly mentioning v8.0.31.

This is a serious issue as these packages got signed by your pgp key. Please communicate openly how that version came to be and inform us whether we do have to clean up our server if these were rouge packages.