Live › vulnerability › CVE-2026-112368
Go to dashboardThe MongoDB PHP driver's BSON decoder recurses without limit, so a crafted binary document can exhaust the process stack. The PHP process using the driver then terminates, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that pass binary BSON data from untrusted sources to the MongoDB PHP driver's decoder can be crashed by a single crafted document. Systems that only read BSON from trusted databases or internal services are less exposed. unknown whether the sources name specific driver versions.
No product ranges from the sources yet.
php -i | grep -i mongodb or php --ri mongodbcomposer.lock for mongodb/mongodb and the ext-mongodb version the project pinsext-mongodb) to the patched release named in the MongoDB advisory; unknown for the exact version in the sourcesmongodb/mongodb library if it is in use; unknown for the exact versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
This page as .md · .json · in your agent: get_signal("CVE-2026-112368")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.