MongoDB PHP Driver
6 CVEs affecting MongoDB PHP Driver. Latest disclosed: 2026-10-08. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81525 | High | 8.1 | 2026-08-27 | The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct… |
CVE-2025-12119 | Medium | 6.8 | 2025-11-18 | A mongoc_bulk_operation_t may read invalid memory if large options are passed. |
CVE-2026-96745 | Medium | 5.6 | 2026-09-24 | Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored… |
CVE-2026-84968 | Medium | 5.3 | 2026-09-03 | An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a… |
CVE-2026-106436 | Medium | 4.8 | 2026-10-08 | The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an in… |
CVE-2026-106432 | Low | 3.6 | 2026-10-08 | The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4… |