Vulnerability · Published Oct 19, 2026 · Assigned by mongodb
CVE-2026-112368Unbounded Recursion in phongo_bson_visit_document/visit_array:
High 7.5
In plain English
A high-severity security flaw in PHP Driver from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | php-mongodb | no fix listed | DEBIAN-CVE-2026-112368 |
| Debian:13 | php-mongodb | 2.0.0-1+deb13u2 | DEBIAN-CVE-2026-112368 |
| Debian:14 | php-mongodb | 2.5.5-1 | DEBIAN-CVE-2026-112368 |
| Ubuntu:22.04:LTS | php-mongodb | no fix listed | UBUNTU-CVE-2026-112368 |
| Ubuntu:24.04:LTS | php-mongodb | no fix listed | UBUNTU-CVE-2026-112368 |
| Ubuntu:26.04:LTS | php-mongodb | no fix listed | UBUNTU-CVE-2026-112368 |
| Ubuntu:26.10 | php-mongodb | no fix listed | UBUNTU-CVE-2026-112368 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc. | PHP Driver | 1.0.0 – before 1.21.122.1.0 – before 2.1.122.5.0 – before 2.5.5 |
Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H