CVE-2026-106436
4.8 MEDIUMPublished 2026-10-08 · Updated 2026-10-13
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-252
Vendors
mongodb
Products
php driver
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-107785
- HIGHCVE-2026-107838PoC
- UNSCOREDCVE-2026-18397
- HIGHCVE-2026-48503PoC
- HIGHCVE-2026-48741PoC
- UNSCOREDCVE-2026-67409PoC
- HIGHCVE-2026-71180
- HIGHCVE-2026-77207
Related by shared AI tags and CWE weakness class. Browse the full archive.