CVE-2026-106436

The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://jira.mongodb.org/browse/PHPC-2739	Vendor Advisory Issue Tracking

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mongodb:php_driver::::::mongodb::*
	cpe:2.3:a:mongodb:php_driver::::::mongodb::*
	cpe:2.3:a:mongodb:php_driver::::::mongodb::*

History

13 Oct 2026, 20:13

Type	Values Removed	Values Added
References	~~() https://jira.mongodb.org/browse/PHPC-2739 -~~	() https://jira.mongodb.org/browse/PHPC-2739 - Vendor Advisory, Issue Tracking
CPE		cpe:2.3:a:mongodb:php_driver::::::mongodb::*
First Time		Mongodb php Driver Mongodb

08 Oct 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-08 20:17

Updated : 2026-10-13 20:13

NVD link : CVE-2026-106436

Mitre link : CVE-2026-106436

CVE.ORG link : CVE-2026-106436

JSON object : View

Products Affected

mongodb

php_driver

CWE

CWE-252

Unchecked Return Value

{"id": "CVE-2026-106436", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106436", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T19:51:56.225896Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@mongodb.com", "affectedData": [{"vendor": "MongoDB", "product": "PHP Driver", "versions": [{"status": "affected", "version": "1.3.0", "lessThan": "1.21.11", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.1.11", "versionType": "semver"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.5.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-08T20:17:31.087", "references": [{"url": "https://jira.mongodb.org/browse/PHPC-2739", "tags": ["Vendor Advisory", "Issue Tracking"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-252"}]}], "descriptions": [{"lang": "en", "value": "The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required."}], "lastModified": "2026-10-13T20:13:16.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*", "vulnerable": true, "matchCriteriaId": "D9601B99-E4C8-47F2-889C-D2177C402836", "versionEndExcluding": "1.21.1", "versionStartIncluding": "1.3.0"}, {"criteria": "cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*", "vulnerable": true, "matchCriteriaId": "FAD08311-777E-4764-859A-373248E2EB0A", "versionEndExcluding": "2.1.11", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*", "vulnerable": true, "matchCriteriaId": "61EA2259-624F-4312-8FD2-D7737C20AA9C", "versionEndExcluding": "2.5.4", "versionStartIncluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}