Executive brief
A vulnerability in the MongoDB PHP driver can cause applications to crash when they process specifically crafted, deeply nested data. This driver is used by PHP applications to communicate with MongoDB databases; however, this specific issue occurs when the application processes data from sources other than a standard MongoDB Server. An exploit results in a denial-of-service, potentially taking down web services or background processes that rely on the driver.
Technical details
The MongoDB PHP driver (PHPC) lacks a nesting limit for BSON documents during field path tracking, leading to uncontrolled recursion (CWE-674). While the underlying libbson and MongoDB Server typically enforce a nesting limit of 100, the PHP driver did not independently enforce this, allowing for stack exhaustion and subsequent application crashes. The attack vector requires the application to process BSON documents from a source other than a trusted MongoDB Server. The issue has been resolved by enforcing BSON nesting limits in versions 1.21.5 and 2.1.8.
Affected products
- MongoDB PHP Driver Versions prior to 1.21.5 and 2.1.8
Timeline
- 2025-10-06: other: Issue reported internally to MongoDB
- 2026-02-04: patched: Issue resolved in development branch
- 2026-05-14: disclosed: CVE published and advisory released