CVE-2026-106436CWE-252
CVE-2026-106436
Medium · published October 9, 2026
What it is
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
The record
Technical detail
- CVSS v3.1
- 4.8 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
- CVSS v4.0
- 6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
- EPSS
- 0.00256 · 16.2th percentile
- Weakness
- CWE-252 · Unchecked Return Value
- Published
- 2026-10-09T00:17Z
Affected products (3)
| Product | Versions | Fixed in |
|---|
| mongodb/php_driver | ≥ 1.3.0, < 1.21.1 | 1.21.1 |
| mongodb/php_driver | ≥ 2.0.0, < 2.1.11 | 2.1.11 |
| mongodb/php_driver | ≥ 2.2.0, < 2.5.4 | 2.5.4 |
References (1)
EPSS history
Timeline
10 OCT 03:27Z
EPSS moved — → 0%
epss
08 OCT 19:03Z
Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver
cvelistv5
08 OCT 19:03Z
Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver
cvelistv5