CVE-2026-106436
Medium · 4.8CVSS
4.8
EPSS
0.3%
Published
Oct 8, 2026
CISA due date
—
The record
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli… CWE-252
- CVE-2026-110353 HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of… CWE-252
- CVE-2026-86141 xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt… CWE-252
- CVE-2026-19534 undici's WebSocket client crashes the whole Node.js process during the opening handshake… CWE-252
- CVE-2026-85649 (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password… CWE-252
- CVE-2026-14957 In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and… CWE-252
- CVE-2026-78699 Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can… CWE-252
- CVE-2026-79772 Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the… CWE-252