What’s Vulnerable › Products

MongoDB PHP Driver vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your MongoDB PHP Driver version is affected

Latest MongoDB PHP Driver vulnerabilities

• CVE-2026-112368 — Unbounded Recursion in phongo_bson_visit_document/visit_array: (CVSS 7.5)
• CVE-2026-106436 — Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver (CVSS 6.5)
• CVE-2026-106432 — Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver (CVSS 8.2)
• CVE-2026-96745 — PHP object injection via unsuppressible __pclass class inference in command monitoring events (CVSS 5.6)
• CVE-2026-84968 — Heap out-of-bounds read via corrupt nested BSON in field path error message (CVSS 5.3)
• CVE-2026-81525 — Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver (CVSS 8.1)
• CVE-2026-6811 — PHP Stack Exhaustion (CVSS 7.5)
• CVE-2025-12119 — Bulk write with options may read invalid memory (CVSS 3.3)
• CVE-2024-7553 — Accessing Untrusted Directory May Allow Local Privilege Escalation (CVSS 7.8)
• CVE-2021-32050 — Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application (CVSS 7.5)