CVE-2026-106436

Name of the Vulnerable Software and Affected Versions MongoDB PHP Driver (affected versions not specified)

Description The BSON encoder fails to verify certain return values when a document exceeds the size limit of libbson, which can leave the encoder in an invalid state. An unauthenticated actor can exploit this by forcing an application to encode an unusually large data structure, potentially leading to the termination of the PHP worker or causing the resulting document to omit fields. This issue does not require a MongoDB server connection or database authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.