CVE-2026-6811Medium· 5.9▾ SunlitStack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.4%
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
php_driver >= 1.21.0, < 1.21.5php_driver >= 2.1.0, < 2.1.8Upgrade past the affected range:
php_driver 2.1.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106432Low· 3.6The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation
CVE-2026-106436Medium· 4.8The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit
CVE-2026-81525High· 8.1The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations
CVE-2026-84968Medium· 5.3An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is …
CVE-2021-45105Medium· 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups
CVE-2022-50407Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - increase the memory of local variables Increase the buffer to prevent stack overflow by fuzz test