Uncontrolled Recursion Vulnerability in MongoDB PHP Driver
CVE-2026-112368

8.2HIGH

Key Information:

Vendor

MongoDB
Status
PHP Driver
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112368?

The MongoDB PHP driver exhibits an uncontrolled recursion flaw in its BSON decoding logic. This vulnerability allows unauthenticated attackers to send specially crafted binary document data, potentially exhausting the process stack and causing the PHP process to terminate unexpectedly. As this issue occurs below the PHP layer, it bypasses application-level error handling mechanisms, leading to a critical loss of availability for applications relying on the driver.

Affected Version(s)

PHP Driver 1.0.0 < 1.21.12

PHP Driver 2.1.0 < 2.1.12

PHP Driver 2.5.0 < 2.5.5

References

https://jira.mongodb.org/browse/PHPC-276

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.