CVE-2026-112368
7.5HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-674
Impact
Remote, unauthenticated attackers can crash PHP processes by sending crafted BSON documents that exhaust the process stack. This causes a denial of service that PHP application-level error handling cannot catch.
Root cause
The MongoDB PHP driver lacks recursion depth limits in its native BSON decoding logic, triggering stack exhaustion.
Affected systems
MongoDB PHP driver (mongodb extension); specific affected versions are not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade the MongoDB PHP extension via PECL once a patched release is published, or avoid passing untrusted raw BSON directly into the decoder.
$ pecl upgrade mongodbAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.