CVE-2026-106436: Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using the affected MongoDB PHP Driver are exposed when an unauthenticated actor can cause them to BSON-encode an unusually large data structure. A MongoDB server connection and database authentication are not required for exploitation.
What impact can exploitation have on the application?
The PHP worker can terminate, causing a denial of service. The invalid encoder state can also produce a document with fields omitted, resulting in data truncation.
What should be investigated to determine whether an application is at risk?
Identify application paths that accept attacker-controlled input and pass it into BSON encoding, especially paths where input can be expanded into unusually large nested structures or documents. Determine whether those paths can be reached without authentication.