Description
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MongoDB | PHP Driver | 1.3.0 – < 1.21.11, 2.0.0 – < 2.1.11, 2.2.0 – < 2.5.4 | 1.21.11 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | php-mongodb | 2.5.5-1 | — |
| Debian 13 | php-mongodb | 2.0.0-1+deb13u2 | — |
| Debian 12 | php-mongodb | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | php-mongodb | No fix yet | — |
| Ubuntu 26.04 LTS | php-mongodb | No fix yet | — |
| Ubuntu 24.04 LTS | php-mongodb | No fix yet | — |
| Ubuntu 22.04 LTS | php-mongodb | No fix yet | — |
| Ubuntu 20.04 LTS | php-mongodb | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | php-mongodb | No fix yet | — |
| Ubuntu 16.04 LTS | php-mongodb | No fix yet | — |
Advisories 1
- WID-SEC-2026-3830 MongoDB Treiber: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026