CVE-2026-106436 MongoDB CVE debrief

Who should care

PHP developers and administrators using MongoDB PHP Driver, especially those handling large data structures, should assess exposure and prioritize updates or compensating controls.

Why it matters

CVE-2026-106436 is a medium-severity vulnerability in MongoDB PHP Driver that can lead to denial of service and data truncation. Defenders should prioritize updates or compensating controls, especially when handling large data structures.

• Denial of service through PHP worker termination
• Data truncation leading to potential field omissions
• Need for input validation and sanitization
• Version updates required for affected versions

Technical summary

The BSON encoder in MongoDB PHP Driver does not check return values after a document exceeds libbson's size limit, leaving the encoder in an invalid state. An unauthenticated actor can cause a denial of service or data truncation by encoding an unusually large data structure. This issue can be mitigated by updating MongoDB PHP Driver versions to 1.21.11, 2.1.11, or 2.5.4, or later, and implementing input validation and sanitization for BSON data. Defenders should prioritize updates or compensating controls, especially when handling large data structures.

Defensive priority

Medium priority for PHP Driver users

Recommended defensive actions

• Review and update MongoDB PHP Driver versions to 1.21.11, 2.1.11, or 2.5.4, or later
• Implement input validation and sanitization for BSON data
• Monitor PHP worker logs for termination and document truncation issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program and NVD records detail a denial of service and data truncation issue in MongoDB PHP Driver. The issue arises from unchecked BSON append failures, which can leave the encoder in an invalid state, allowing an unauthenticated actor to terminate the PHP worker or cause document field omissions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.