High
php-mongodb — security advisory
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
- Products
- php-mongodb
- Affected versions
- 1.1.2-2~ubuntu1, 1.1.5-1~build1, 1.11.1+1.9.2+1.7.5-4, 1.12.0+1.9.2+1.7.5-3, 1.12.0+1.9.2+1.7.5-4, 1.15.0+1.11.1+1.9.2+1.7.5-1build1, 1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu1, 1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu2, 1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu3, 1.2.3-1build1, 1.21.0-1, 1.3.4-1build1, 1.5.5-1build1, 1.6.1-4, 1.6.1-4build1, 1.9.0+1.7.5-2build2, 2.0.0-1, 2.1.0-1, 2.1.7-0ubuntu1, 2.1.7-0ubuntu2
- Fixed versions
- Not specified
- CVEs
- CVE-2026-6811
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:14 UTC · Revision 1
Source evidence
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
osv:UBUNTU-CVE-2026-6811
php-mongodb
Fixed versions: Not specified
php-mongodb
Fixed versions: Not specified
php-mongodb
Fixed versions: Not specified
php-mongodb
Fixed versions: Not specified
php-mongodb
Fixed versions: Not specified
php-mongodb
Fixed versions: Not specified
php-mongodb
Fixed versions: Not specified
php-mongodb
Fixed versions: Not specified
Complete source record
{
"id": "4eeeb672306b4a7c04044d9e8c0c988e72583306794e439ee5fb56a613ace9d1",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-6811",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-6811",
"summary": "Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.",
"evidence": "osv:UBUNTU-CVE-2026-6811",
"products": [
{
"name": {
"value": "php-mongodb",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.1.2-2~ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1.1.5-1~build1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "php-mongodb",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.2.3-1build1",
"evidence": "/affected/1/versions"
},
{
"value": "1.3.4-1build1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "php-mongodb",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.5-1build1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.1-4",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.1-4build1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "php-mongodb",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.9.0+1.7.5-2build2",
"evidence": "/affected/3/versions"
},
{
"value": "1.11.1+1.9.2+1.7.5-4",
"evidence": "/affected/3/versions"
},
{
"value": "1.12.0+1.9.2+1.7.5-3",
"evidence": "/affected/3/versions"
},
{
"value": "1.12.0+1.9.2+1.7.5-4",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "php-mongodb",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.15.0+1.11.1+1.9.2+1.7.5-1build1",
"evidence": "/affected/4/versions"
},
{
"value": "1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu1",
"evidence": "/affected/4/versions"
},
{
"value": "1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu2",
"evidence": "/affected/4/versions"
},
{
"value": "1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu3",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "php-mongodb",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.21.0-1",
"evidence": "/affected/5/versions"
},
{
"value": "2.0.0-1",
"evidence": "/affected/5/versions"
},
{
"value": "2.1.0-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "php-mongodb",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.1.7-0ubuntu1",
"evidence": "/affected/6/versions"
},
{
"value": "2.1.7-0ubuntu2",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "php-mongodb",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.1.0-1",
"evidence": "/affected/7/versions"
},
{
"value": "2.1.7-0ubuntu1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-6811",
"aliases": [
"UBUNTU-CVE-2026-6811"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-mongodb",
"purl": "pkg:deb/ubuntu/php-mongodb?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.1.2-2~ubuntu1",
"1.1.5-1~build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6811.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-mongodb",
"binary_version": "1.1.5-1~build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-mongodb",
"purl": "pkg:deb/ubuntu/php-mongodb?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.2.3-1build1",
"1.3.4-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6811.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-mongodb",
"binary_version": "1.3.4-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-mongodb",
"purl": "pkg:deb/ubuntu/php-mongodb?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.5.5-1build1",
"1.6.1-4",
"1.6.1-4build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6811.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-mongodb",
"binary_version": "1.6.1-4build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-mongodb",
"purl": "pkg:deb/ubuntu/php-mongodb?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.9.0+1.7.5-2build2",
"1.11.1+1.9.2+1.7.5-4",
"1.12.0+1.9.2+1.7.5-3",
"1.12.0+1.9.2+1.7.5-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6811.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-mongodb",
"binary_version": "1.12.0+1.9.2+1.7.5-4"
},
{
"binary_name": "php8.1-mongodb",
"binary_version": "1.12.0+1.9.2+1.7.5-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-mongodb",
"purl": "pkg:deb/ubuntu/php-mongodb?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.15.0+1.11.1+1.9.2+1.7.5-1build1",
"1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu1",
"1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu2",
"1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6811.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-mongodb",
"binary_version": "1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu3"
},
{
"binary_name": "php8.3-mongodb",
"binary_version": "1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-mongodb",
"purl": "pkg:deb/ubuntu/php-mongodb?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.21.0-1",
"2.0.0-1",
"2.1.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6811.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-mongodb",
"binary_version": "2.1.0-1"
},
{
"binary_name": "php8.4-mongodb",
"binary_version": "2.1.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-mongodb",
"purl": "pkg:deb/ubuntu/php-mongodb?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"2.1.7-0ubuntu1",
"2.1.7-0ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6811.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-mongodb",
"binary_version": "2.1.7-0ubuntu2"
},
{
"binary_name": "php8.5-mongodb",
"binary_version": "2.1.7-0ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-mongodb",
"purl": "pkg:deb/ubuntu/php-mongodb?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2.1.0-1",
"2.1.7-0ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6811.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-mongodb",
"binary_version": "2.1.7-0ubuntu1"
},
{
"binary_name": "php8.5-mongodb",
"binary_version": "2.1.7-0ubuntu1"
}
]
}
}
],
"modified": "2026-10-17T13:00:39.951042987Z",
"provider": "osv",
"upstream": [
"CVE-2026-6811"
],
"references": [
"https://ubuntu.com/security/CVE-2026-6811",
"https://www.cve.org/CVERecord?id=CVE-2026-6811",
"https://jira.mongodb.org/browse/PHPC-2636"
]
},
"related_cves": [
{
"value": "CVE-2026-6811",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 360767,
"published_at": "2026-05-14T22:16:00+00:00"
}