Priority LOW 28
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit.
Vulnerabilities
8 records
Priority LOW 10
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation.
TI-2026-58391 CVE-2026-84968
Heap out-of-bounds read via corrupt nested BSON in field path error message
Priority LOW 36
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error…
TI-2026-56246 CVE-2026-81525 · GHSA-65fr-j4p9-vc33
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
Priority MEDIUM 40
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations.
TI-2026-05975 CVE-2026-6811 · GHSA-vc69-vr6f-4x67
PHP Stack Exhaustion
Priority LOW 27
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
TI-2025-11114 CVE-2025-12119 · GHSA-mwcc-7vpp-xmv9
Bulk write with options may read invalid memory
Priority LOW 30
A mongoc_bulk_operation_t may read invalid memory if large options are passed.
TI-2024-07001 CVE-2024-7553 · GHSA-5m47-pw5x-gvrc
Accessing Untrusted Directory May Allow Local Privilege Escalation
Priority LOW 36
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows.
TI-2021-12015 CVE-2021-32050 · GHSA-vxvm-qww3-2fh7
Information disclosure in MongoDB C Driver
Priority LOW 34
Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application.