Quick answers
- Is CVE-2026-6811 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-6811 being exploited in the wild.
- How severe is CVE-2026-6811?
- Medium severity, with a CVSS score of 5.9, published 14 May 2026.
- Which products and versions are affected?
- MongoDB PHP Driver Versions prior to 1.21.5 and 2.1.8.
- Is there a fix for CVE-2026-6811?
- A patch was published on 2026-02-04: Issue resolved in development branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-6811 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-6811?
- Check whether you run MongoDB PHP Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The MongoDB PHP driver (PHPC) lacks a nesting limit for BSON documents during field path tracking, leading to uncontrolled recursion (CWE-674). While the underlying libbson and MongoDB Server typically enforce a nesting limit of 100, the PHP driver did not independently enforce this, allowing for stack exhaustion and subsequent application crashes. The attack vector requires the application to process BSON documents from a source other than a trusted MongoDB Server. The issue has been resolved by enforcing BSON nesting limits in versions 1.21.5 and 2.1.8.
Affected products
- MongoDB PHP Driver Versions prior to 1.21.5 and 2.1.8
Timeline
- 2025-10-06: other: Issue reported internally to MongoDB
- 2026-02-04: patched: Issue resolved in development branch
- 2026-05-14: disclosed: CVE published and advisory released