Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-112368

Unbounded Recursion in phongo_bson_visit_document/visit_array:

An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Php Driver
CVE-2026-106436

Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver

The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Php Driver
CVE-2026-106432

Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Php Driver
CVE-2026-81525

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Php Driver Php Extension Php Library
CVE-2026-96745

PHP object injection via unsuppressible __pclass class inference in command monitoring events

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Php Driver
CVE-2026-6811

PHP Stack Exhaustion

Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Php Driver
CVE-2026-84968

Heap out-of-bounds read via corrupt nested BSON in field path error message

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Php Driver
CVE-2025-12119

Bulk write with options may read invalid memory

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C Driver Php Driver
CVE-2021-32050

Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C\+\+ C Driver Node.js and 2 more
CVE-2024-7553

Accessing Untrusted Directory May Allow Local Privilege Escalation

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Mongodb
Products
Windows 10 1507 Windows 10 1511 Windows 10 1607 and 21 more