# CVE-2026-6811: Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested…

Source: https://junglewise.ai/threats/cve-2026-6811-mongodb-php-driver-stack-exhaustion-in-bson-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-6811 · Severity: medium · CVSS 5.9 · Published 2026-05-14

A vulnerability in the MongoDB PHP driver can cause applications to crash when they process specifically crafted, deeply nested data. This driver is used by PHP applications to communicate with MongoDB databases; however, this specific issue occurs when the application processes data from sources other than a standard MongoDB Server. An exploit results in a denial-of-service, potentially taking down web services or background processes that rely on the driver.

Technologies: [MongoDB PHP Driver](https://junglewise.ai/threats/technologies/php-driver). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-6811 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6811 being exploited in the wild.

**How severe is CVE-2026-6811?** Medium severity, with a CVSS score of 5.9, published 14 May 2026.

**Which products and versions are affected?** MongoDB PHP Driver Versions prior to 1.21.5 and 2.1.8.

**Is there a fix for CVE-2026-6811?** A patch was published on 2026-02-04: Issue resolved in development branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6811 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6811?** Check whether you run MongoDB PHP Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MongoDB PHP driver (PHPC) lacks a nesting limit for BSON documents during field path tracking, leading to uncontrolled recursion (CWE-674). While the underlying libbson and MongoDB Server typically enforce a nesting limit of 100, the PHP driver did not independently enforce this, allowing for stack exhaustion and subsequent application crashes. The attack vector requires the application to process BSON documents from a source other than a trusted MongoDB Server. The issue has been resolved by enforcing BSON nesting limits in versions 1.21.5 and 2.1.8.

## Affected products

- MongoDB PHP Driver Versions prior to 1.21.5 and 2.1.8

## Timeline

- 2025-10-06: other: Issue reported internally to MongoDB
- 2026-02-04: patched: Issue resolved in development branch
- 2026-05-14: disclosed: CVE published and advisory released

## References

- [https://jira.mongodb.org/browse/PHPC-2636](https://jira.mongodb.org/browse/PHPC-2636)

## Related threats

- [MongoDB PHP driver uncontrolled recursion in BSON decoding](https://junglewise.ai/threats/cve-2026-112368-an-uncontrolled-recursion-weakness-in-the-bson-decoding-logic-of)
- [MongoDB PHP Driver BSON encoder unchecked return values](https://junglewise.ai/threats/cve-2026-106436-the-bson-encoder-in-the-mongodb-php-driver-does-not-check-some)
- [The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an…](https://junglewise.ai/threats/cve-2026-106432-the-bson-encoder-in-the-mongodb-php-driver-converts-a-string)
- [MongoDB PHP Driver deserialization of untrusted data in command monitoring](https://junglewise.ai/threats/cve-2026-96745-deserialization-of-untrusted-data-in-the-command-monitoring)
- [MongoDB PHP Driver out-of-bounds read in BSON decoding](https://junglewise.ai/threats/cve-2026-84968-mongodb-php-driver-out-of-bounds-read-in-bson-decoding)