CVE-2026-106432
LowCVSS 3.6Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. For strings near 4 GiB, allocation can wrap while copy uses original length, causing heap buffer overflow. Requires non-default runtime configuration allowing multi-gigabyte values.
Risk Assessment
Buffer overflow can corrupt process memory or crash the PHP process, potentially leading to denial of service or arbitrary code execution.
Recommendation
Upgrade the MongoDB PHP Driver to a patched version. Limit the size of processed data and avoid configurations allowing very large values.
Other vulnerabilities in MongoDB PHP Driver
See all- CVE-2026-112368High
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process.
- CVE-2026-106436Medium
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
- CVE-2026-96745Medium
A deserialization vulnerability in the command monitoring support of the MongoDB PHP Driver can cause class names from document content to be honored when building monitoring events. An attacker controlling data in database operations may instantiate application classes implementing the persistable interface and invoke their unserialize method.
- CVE-2026-84968Medium
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
- CVE-2026-6811Medium
A stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
Original NVD description (English source)
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS