Cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amongodbphp_driver/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 19 Oct 2026 18:11:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDenial of Service Vulnerability in MongoDB PHP Driver via Uncontrolled Recursionhttps://feed.craftedsignal.io/briefs/2026-10-mongodb-bson-recursion/Mon, 19 Oct 2026 18:11:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mongodb-bson-recursion/An uncontrolled recursion vulnerability (CVE-2026-112368) in the MongoDB PHP driver allows an unauthenticated attacker to trigger stack exhaustion and process termination by providing malicious BSON documents.CVE-2026-112368 identifies a critical weakness in the BSON decoding logic within the MongoDB PHP driver. The vulnerability stems from uncontrolled recursion during the parsing process, which can be triggered by an unauthenticated attacker supplying a specially crafted BSON document. Because the failure occurs at the driver level, beneath the PHP execution layer, standard application-level exception or error handling mechanisms are unable to intercept the crash. Successful exploitation results in immediate process termination, leading to a denial-of-service condition for the affected PHP application. This issue is particularly significant for high-traffic web applications that accept user-supplied or external data payloads for MongoDB operations. Defenders should prioritize auditing applications that parse BSON inputs and apply vendor-provided patches as soon as they become available.

Impact

The impact of this vulnerability is a targeted denial-of-service affecting web applications relying on the MongoDB PHP driver. By causing the PHP process to crash unexpectedly, an attacker can degrade service availability for legitimate users. The inability to catch this error in PHP code means that affected services may require manual intervention or system-level restart logic to recover, potentially causing significant downtime in production environments.

Recommendation

  • Identify all application servers utilizing the MongoDB PHP driver by inspecting dependency manifests (e.g., composer.json) or server environment logs.
  • Monitor web server error logs for recurrent sudden process terminations or segmentation faults occurring during BSON decoding operations.
  • Apply the vendor-provided patch for CVE-2026-112368 across all affected production and development environments once released by MongoDB.
  • Implement input validation and schema enforcement at the application layer to reject unusually deep or malformed BSON documents before they reach the driver level.
]]>lowadvisoryvulnerabilitydenial-of-servicemongodb