MongoDB PHP Driver
8 CVEs affecting MongoDB PHP Driver. Latest disclosed: 2026-10-08. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81525 | High | 8.1 | 2026-08-27 | The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct… |
CVE-2024-7553 | High | 7.3 | 2024-08-07 | Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This… |
CVE-2025-12119 | Medium | 6.8 | 2025-11-18 | A mongoc_bulk_operation_t may read invalid memory if large options are passed. |
CVE-2026-6811 | Medium | 5.9 | 2026-05-14 | Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances wh… |
CVE-2026-84968 | Medium | 5.3 | 2026-09-03 | An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a… |
CVE-2026-106436 | Medium | 4.8 | 2026-10-08 | The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an in… |
CVE-2021-32050 | Medium | 4.2 | 2023-08-29 | Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published ev… |
CVE-2026-106432 | Low | 3.6 | 2026-10-08 | The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4… |