Unbounded Recursion in phongo_bson_visit_document/visit_array:
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
CVE-2026-112368
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-112368
PHP Driver
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "MongoDB Inc.",
"product": "PHP Driver",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "1.21.12",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.1.0",
"lessThan": "2.1.12",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.5.0",
"lessThan": "2.5.5",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-112368
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #42580 · Revision 1
- Added to Heist Feed
- Publisher date