---
id: CVE-2026-106432
title: >-
  The BSON encoder in the MongoDB PHP Driver converts a string length to a
  32-bit value without validation
summary: >-
  The BSON encoder in the MongoDB PHP Driver converts a string length to a
  32-bit value without validation. When an affected application encodes a string
  near 4 GiB, the allocation size can wrap while the copy operation uses the
  original l…
severity: low
cvss: 3.6
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-681
vendor: mongodb
product: php_driver
affected:
  - 'php_driver >= 1.3.0, < 1.21.1'
  - 'php_driver >= 2.0.0, < 2.1.11'
  - 'php_driver >= 2.2.0, < 2.5.4'
patched:
  - php_driver 2.5.4
published: '2026-10-08'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:09:23.800'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106432'
references:
  - url: 'https://jira.mongodb.org/browse/PHPC-2741'
    label: cna@mongodb.com
tags:
  - nvd
  - cve.org
epss: 0.0017
epssPercentile: 0.06389
ingestedAt: '2026-10-08T21:07:56.432Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T19:51:29.386617Z'
---

## Overview

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.

## Affected

- `php_driver >= 1.3.0, < 1.21.1`
- `php_driver >= 2.0.0, < 2.1.11`
- `php_driver >= 2.2.0, < 2.5.4`

## Remediation

Upgrade past the affected range:

- `php_driver 2.5.4`