CVE-2026-106432: Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/php-mongodbto a version that resolves this vulnerability.Fixed in 2.0.0-1+deb13u2Fixed in 2.5.5-1 - Upgrade
Upgrade
debian/php-mongodbto a version that resolves this vulnerability.Fixed in 2.0.0-1+deb13u2 - Upgrade
Upgrade
debian/php-mongodbto a version that resolves this vulnerability.Fixed in 2.5.5-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only applications using the affected MongoDB PHP Driver BSON encoder are exposed, and reaching the flaw requires a non-default PHP runtime configuration that permits multi-gigabyte values. MongoDB server interaction is not required.
What is required to trigger the overflow?
The application must encode a string close to 4 GiB. Its length is converted to a 32-bit value without validation, allowing the allocation size to wrap while copying still uses the original length.
What can happen if the issue is triggered?
The heap buffer overflow can corrupt memory in the PHP process or cause that process to terminate. The stated impact is limited to integrity and availability.
How can teams assess whether they are at risk?
Review whether the application uses the MongoDB PHP Driver to BSON-encode strings and whether its PHP runtime has been configured to allow multi-gigabyte values. Default runtime configurations do not meet the stated prerequisite.