CVE-2026-112368 in PHP Driver
Summary
by MITRE • 10/19/2026
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified involves an uncontrolled recursion weakness within the BSON decoding logic of the MongoDB PHP driver. This flaw allows an attacker who can supply crafted binary document data to trigger a stack exhaustion condition, leading to the termination of the affected PHP process and resulting in a denial of service for that specific instance. The core technical issue stems from how the decoder handles nested or deeply recursive structures within BSON documents. When processing these malformed inputs, the driver fails to enforce adequate depth limits or recursion checks before attempting to decode the data structure. This lack of validation causes the underlying C-level code associated with the driver to enter an infinite or excessively deep recursive loop during the parsing phase. Because this execution occurs at a level below the PHP application layer, standard error handling mechanisms such as try-catch blocks are ineffective in intercepting or mitigating the condition. Consequently, the operating system eventually terminates the process due to stack overflow, causing immediate and ungraceful service disruption for any user relying on that specific PHP worker or thread.
From a classification perspective, this vulnerability aligns with CWE-675, which denotes operations with duplicate inputs leading to unintended side effects such as resource exhaustion. It also relates closely to CWE-400, concerning uncontrolled resource consumption, specifically regarding stack space allocation during recursive function calls. In the context of the MITRE ATT&CK framework, this behavior is indicative of a Denial of Service (DoS) attack vector, where an adversary leverages application logic flaws to degrade or halt service availability without requiring authentication credentials. The absence of input validation for structural depth in binary data parsers is a common pattern that can be exploited by remote attackers who have the ability to submit documents to the database interface. This could include scenarios involving direct API calls, web forms interacting with MongoDB via PHP, or any other entry point where user-supplied BSON-formatted data is processed by the driver.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity. Since the attack results in process termination, it can lead to cascading failures if the application relies on a limited pool of persistent connections or worker processes. In high-traffic environments, repeated exploitation attempts could exhaust available server resources, effectively taking down the entire service layer dependent on that PHP instance. Furthermore, because the crash occurs at the native driver level rather than within managed code, debugging and logging may be less informative compared to standard application-level exceptions, potentially complicating incident response efforts. Attackers can automate this process by generating BSON payloads with deeply nested arrays or objects designed specifically to trigger the recursion limit of the underlying C library used by the extension.
Mitigation strategies should prioritize updating the MongoDB PHP driver to a version that includes patches for this specific decoding logic flaw. Developers must ensure that their deployment pipelines regularly check for and apply security updates provided by the official MongoDB repository. In addition to software patching, architectural controls can help mitigate the impact of such vulnerabilities. Implementing rate limiting on database query endpoints can reduce the frequency of crafted requests reaching the vulnerable code path. Additionally, configuring web servers or reverse proxies to limit request body sizes may prevent extremely large or deeply nested BSON documents from being processed by the application layer before they reach the driver. While these measures do not fix the underlying flaw in the decoder, they raise the barrier for exploitation and reduce the likelihood of successful stack exhaustion attacks. Organizations should also monitor server logs for unexpected PHP process terminations to detect potential ongoing exploitation attempts promptly.