What’s Vulnerable › Vulnerabilities
CVE-2026-106432: Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
- Severity: high (CVSS 8.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-08 · updated 2026-10-13
- Weakness: CWE-681
Description
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.
Affected products
- MongoDB PHP Driver: from 1.3.0 before 1.21.1; from 2.0.0 before 2.1.11; from 2.2.0 before 2.5.4 — fixed in 1.21.1, 2.1.11, 2.5.4
How to fix
Upgrade to a fixed version: MongoDB PHP Driver 1.21.1, 2.1.11, 2.5.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-106432 or the next vulnerability affects your stack