MongoDB PHP Driver: Unbounded recursion in BSON decoder causes denial of service
Summary
The MongoDB PHP driver (mongodb extension) recurses without a depth limit when decoding BSON documents. An unauthenticated party who can supply crafted binary BSON data to the decoder can exhaust the process stack. The PHP process then terminates unexpectedly, which causes a loss of availability; the condition occurs below the PHP layer and cannot be caught by application error handling.
Affected
- MongoDB PHP Driver 1.0.0 to before 1.21.12 (according to the CNA record)
- MongoDB PHP Driver 2.1.0 to before 2.1.12
- MongoDB PHP Driver 2.5.0 to before 2.5.5
- The default configuration is not affected according to the CNA record.
Fixed in
- 1.21.12
- 2.1.12
- 2.5.5
- Or the fixed package from your Linux distribution, if you use one. Check your distribution's tracker for the exact version.
Workaround
- No vendor-documented workaround is known. Upgrading is the fix.
- Interim measure (our recommendation, not from a source): only pass BSON data from trusted sources to the decoder.
- Interim measure (our recommendation, not from a source): run PHP workers under a process supervisor so that a crash does not take down the whole service.
Exploitation
- CISA SSVC: exploitation none, automatable yes. Not listed in CISA KEV.
- No public exploitation known as of 2026-10-23 (cve.radio).
- EPSS reported at about 0.3%.
- No public proof of concept found.
Our recommendation
- Inventory PHP hosts with the mongodb extension and record their versions (php --ri mongodb).
- Upgrade to 1.21.12, 2.1.12 or 2.5.5, or install the fixed package from your distribution.
- Prioritise internet-facing PHP applications that process external BSON or MongoDB data.
- Monitor for repeated PHP worker crashes (SIGSEGV) as a possible sign of attempted exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MongoDB Jira: PHPC-276 jira.mongodb.org
- GitHub: mongo-php-driver pull request 2158 github.com
- GitHub: mongo-php-driver release 2.5.5 github.com
- GitHub: mongo-php-driver release 2.1.12 github.com
- OpenCVE: CVE-2026-112368 app.opencve.io
- cve.radio: CVE-2026-112368 cve.radio
- Vulners: Red Hat CVE RH:CVE-2026-112368 vulners.com
- PECL news pecl.php.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:44.
Original description (NVD)
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.