CVE-2026-106436

The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.

• CWE-252

• https://jira.mongodb.org/browse/PHPC-2739

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10643Zephyr's IP socket recvmsg() implementation (subsys/net/lib/…7.8
• CVE-2026-106430The MongoDB C++ Driver discards content after an embedded NU…5.9
• CVE-2026-106431An off-by-one error in the BSON bulk document writer in the …5.7
• CVE-2026-106432The BSON encoder in the MongoDB PHP Driver converts a string…3.6
• CVE-2026-106433Improper state management in MongoDB libmongocrypt can cause…8.8
• CVE-2026-106434The explicit decryption component of MongoDB libmongocrypt c…4.3
• CVE-2026-106437The BSON buffer-reservation API in the MongoDB C Driver can …6.2
• CVE-2026-106438An incorrect calculation in Decimal128 string parsing in the…4
• CVE-2026-106439Hydra is a framework for elegantly configuring complex appli…8.5
• CVE-2026-10644The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mch…3.1
• CVE-2026-106440Hydra is a framework for elegantly configuring complex appli…7.8
• CVE-2026-106441Hydra is a framework for elegantly configuring complex appli…7.8