CVE-2026-106436
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
Risk Assessment
A PHP worker may be terminated or data integrity lost through omitted fields, leading to denial of service or data errors.
Recommendation
Update the MongoDB PHP Driver to a version containing the fix or avoid encoding unusually large data structures.
Other vulnerabilities in MongoDB PHP Driver
See all- CVE-2026-112368High
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process.
- CVE-2026-106432Low
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. For strings near 4 GiB, allocation can wrap while copy uses original length, causing heap buffer overflow. Requires non-default runtime configuration allowing multi-gigabyte values.
- CVE-2026-96745Medium
A deserialization vulnerability in the command monitoring support of the MongoDB PHP Driver can cause class names from document content to be honored when building monitoring events. An attacker controlling data in database operations may instantiate application classes implementing the persistable interface and invoke their unserialize method.
- CVE-2026-84968Medium
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
- CVE-2026-6811Medium
A stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
Original NVD description (English source)
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS