PKSA-cknr-8ckg-k248: EncryptedFieldsMapGenerator may silently omit encrypted fields when a document has embedded documents

Q: Should processing errors be relied on to detect this issue?

No. The affected behavior is silent omission of encrypted fields, so an error may not be produced when it occurs.

Q: What data should be prioritized for review?

Prioritize documents containing embedded documents. Verify that all fields expected to be encrypted were included, as encrypted fields may be omitted in those documents.

Published Nov 3, 2026

Updated

EncryptedFieldsMapGenerator may silently omit encrypted fields when a document has embedded documents

Affected Software

1 affected componentFixes available

composer/doctrine/mongodb-odm>=2.12.0, <2.17.3

2.17.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/doctrine/mongodb-odm to a version that resolves this vulnerability.
Fixed in 2.17.3

Event History

Nov 3, 2026

Advisory Published

via Packagist·05:21 AM

Data Sourced

via Packagist·05:21 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Should processing errors be relied on to detect this issue?

No. The affected behavior is silent omission of encrypted fields, so an error may not be produced when it occurs.

What data should be prioritized for review?

Prioritize documents containing embedded documents. Verify that all fields expected to be encrypted were included, as encrypted fields may be omitted in those documents.