CVE-2026-112368

What it actually does

Uncontrolled recursion in BSON decoding exhausts the process stack, causing the PHP process to terminate without application-level error handling interception.

Why it matters to the business

PHP applications relying on the MongoDB driver experience sudden unavailability when handling attacker-supplied data, disrupting services for up to seven days post-publication with potential for broad operational downtime.

How an attack unfolds

An unauthenticated attacker crafts a malicious binary BSON document and supplies it to any PHP application endpoint that triggers the driver's decoder, inducing deep recursion that crashes the process.

How to fix it

Upgrade the MongoDB PHP driver to the latest patched release addressing BSON recursion; until available, restrict untrusted BSON input sources and monitor vendor advisories for exact fixed versions.

How to confirm the fix worked

Replay crafted BSON test cases against updated driver builds to confirm absence of stack exhaustion; review release notes for recursion depth safeguards.

Typical attack path

1. Locate a PHP application exposing MongoDB driver functionality to external input
2. Generate a deeply nested or malformed BSON payload designed to trigger recursion
3. Transmit the payload over the network to the decoder entry point
4. Observe process termination and resulting denial of service

How to detect it

Review PHP and web server logs for abrupt process terminations correlated with MongoDB BSON operations; inspect for patterns of malformed document submissions in application request logs.

What your security team should do

• Prioritize driver updates within standard patching windows given seven-day publication age and absence from KEV
• Add network-level rate limiting on endpoints accepting binary document data
• Enable PHP process monitoring and automatic restarts for availability resilience