CVE-2026-112368
Description
A flaw was found in the MongoDB PHP driver. An uncontrolled recursion vulnerability in the Binary JSON (BSON) decoding logic allows an unauthenticated remote attacker to cause a Denial of Service (DoS). By supplying specially crafted binary document data to the decoder, an attacker can exhaust the process stack, leading to an unexpected crash of the underlying PHP process.
Statement
Red Hat has rated this vulnerability as Important because an unauthenticated attacker capable of providing arbitrary BSON data can induce native stack exhaustion and crash PHP worker processes remotely without requiring elevated privileges. The failure occurs within the underlying driver C extension, bypassing user-space exception handling and causing immediate process termination. While serious for services parsing untrusted input, the MongoDB PHP extension is not shipped in core Red Hat Enterprise Linux repositories and is only available through Extra Packages for Enterprise Linux (EPEL).
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce recursion depth boundaries or restrict the intake of untrusted binary BSON payloads processed by the MongoDB PHP driver decoder: upgrade to php-pecl-mongodb 1.21.12, 2.1.12, 2.5.5 (or the fixed Php Pecl Mongodb builds), which enforces recursion depth bounds in phongo_bson_visit_document and visit_array during BSON decoding to prevent stack exhaustion crashes, closing all 2 injection vectors (deeply nested BSON documents, deeply nested BSON arrays). Until patched, this is a concern on PHP applications decoding untrusted binary BSON documents via the MongoDB PHP driver across any platform, so Restrict unauthenticated network access to endpoints handling binary BSON decoding and validate incoming document structure before invoking parser routines. As a compensating measure, Configure systemd WatchdogSec and Restart directives to automatically restart PHP processes upon abrupt termination from stack exhaustion and Implement rate limiting and connection throttling to restrict request frequency from unauthenticated callers and prevent sustained service disruption. These controls limit blast radius and contain exploitation, but they do not fix the underlying uncontrolled recursion defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1204 Service Watchdog and Automatic Restart (systemd WatchdogSec/Restart) (medium)
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
