CVE-2026-6811CWE-674

CVE-2026-6811

Medium · published May 15, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-05-15T02:16Z
Affected products (2)
ProductVersionsFixed in
mongodb/php_driver≥ 1.21.0, < 1.21.51.21.5
mongodb/php_driver≥ 2.1.0, < 2.1.82.1.8
References (1)
https://jira.mongodb.org/browse/PHPC-2636 · [email protected]
EPSS history
Timeline
  • 14 MAY 21:27Z
    PHP Stack Exhaustion
    cvelistv5