CVE-2026-112368: Unbounded Recursion in phongo_bson_visit_document/visit_array:
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
PHP processes that use the MongoDB PHP driver and decode BSON data supplied by an unauthenticated party are exposed. An attacker can trigger the condition remotely if they can provide crafted binary BSON document data to the decoder.
What does successful exploitation require?
The attacker needs only to supply crafted binary document data to the driver's BSON decoder. No authentication or user interaction is required.
What is the operational impact?
Exploitation can exhaust the process stack and cause the affected PHP process to terminate unexpectedly, producing a denial of service for that process. Confidentiality and integrity impacts are not indicated by the provided severity vector.
Can application-level PHP error handling prevent the crash?
No. The recursion condition occurs below the PHP layer and cannot be intercepted by application-level error handling.