CVE Feed

    Dashboard / CVE / CVE-2026-106436

    CVE-2026-106436

    The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.

    Published:Oct 8, 2026
    Last Modified:Oct 13, 2026
    EPS:Oct 8, 2026
    EPSS Score:0.00257
    CVSS Score:4.8

    Affected Products

    Vendor
    Mongodb
    Product
    Php Driver

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-252 Unchecked Return Value

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-112368 (CVSS 8.2) — An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthent…
    CVE-2026-106432 (CVSS 2) — The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When…
    CVE-2026-96745 (CVSS 6.3) — Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class …
    CVE-2026-84968 (CVSS 6.9) — An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated pa…
    CVE-2026-81525 (CVSS 8.6) — The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied nam…
    CVE-2026-6811 (CVSS 6) — Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply …
    CVE-2025-12119 (CVSS 6.9) — A mongoc_bulk_operation_t may read invalid memory if large options are passed.…
    CVE-2024-7553 (CVSS 7.3) — Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if …
    CVE-2021-32050 (CVSS 4.2) — Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listen…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High