Php Driver (Mongodb) - vulnerabilities (CVEs)

8 CVEs, 2 in the last 30 days, 159 known versions, newest CVE from 2026-10-08. Vendor: Mongodb.

CVEs of Php Driver

• CVE-2026-106436 - CVSS 6.5 (medium), 2026-10-08: The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an…
• CVE-2026-106432 - CVSS 8.2 (high), 2026-10-08: The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4…
• CVE-2026-96745 - CVSS 6.3 (medium), 2026-09-24: Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored…
• CVE-2026-84968 - CVSS 6.9 (medium), 2026-09-03: An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have…
• CVE-2026-81525 - CVSS 8.6 (high), 2026-08-27: The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to…
• CVE-2026-6811 - CVSS 7.5 (high), 2026-05-14: Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances…
• CVE-2025-12119 - CVSS 6.9 (medium), 2025-11-18: A mongoc_bulk_operation_t may read invalid memory if large options are passed.
• CVE-2024-7553 - CVSS 7.8 (high), 2024-08-07: Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows.…
• CVE-2021-32050 - CVSS 7.5 (high), 2023-08-29: Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published…