Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-106436

The BSON encoder in the MongoDB PHP Driver does not check some return values after a document…

Risk score
52/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause th…
Affected
Mongodb Php Driver
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Mongodb Php DriverTHE FLAWSTHE FIXCVE-2026-106436The BSON encoder in theMongoDB PHP Driver does notcheck some return values…CVSS 6.5 · EPSS 0%CVE-2026-106432The BSON encoder in theMongoDB PHP Driver converts astring length to a 32-bit value…CVSS 8.2 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedMongodb Php DriverAMBER · PATCH THIS WEEKMongodb PhpDriverThe BSON encoder in theMongoDB PHP Driver converts astring length to a 32-bit valuewithout validation. When anaffected application encodes astring near 4 GiB, the allocationsize can wrap while the copy…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-252 (CWE-252)11 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Mongodb Php Driver: Amber, patch this week. The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate …

The flaws

  • CVE-2026-106436: The BSON encoder in the MongoDB PHP Driver does not check some return values after a document… (CVSS 6.5 · EPSS 0%)
  • CVE-2026-106432: The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without… (CVSS 8.2 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Mongodb Php Driver

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: php

References

Original description

The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.

Last activity 8 Oct 2026. Patch Forecast updates every hour.