CVE-2026-106436
Description
A flaw was found in the MongoDB PHP Driver. The Binary JSON (BSON) encoder fails to properly check return values when data exceeds the library size limit, leaving the encoder in an invalid state. An unauthenticated remote attacker who can induce the application to encode an unusually large data structure can exploit this vulnerability to crash the PHP worker process, causing a Denial of Service (DoS), or lead to omitted fields in the generated document.
Statement
Moderate severity is assigned because a remote attacker can trigger worker termination or data omissions during BSON serialization without database credentials, while confidentiality remains unaffected and the impact is confined to the specific PHP worker process. In Red Hat environments, the affected MongoDB driver extension is not provided in core Red Hat Enterprise Linux channels and is only available through community streams such as Fedora and EPEL. Exploitation additionally requires an application to accept and serialize untrusted data that exceeds driver size boundaries.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: Unexpected State; DoS: Crash, Exit, or Restart
An unexpected return value could place the system in a state that could lead to a crash or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
