CVE-2026-106436: CWE-252: Unchecked Return Value in MongoDB PHP Driver

The BSON encoder component of the MongoDB PHP Driver does not verify some return values when encoding documents that exceed the size limit imposed by libbson. This unchecked return value issue can leave the encoder in an invalid state. An unauthenticated attacker able to induce encoding of an unusually large data structure can cause denial of service by terminating the PHP worker process or cause data integrity issues by omitting fields in the resulting BSON document. No database authentication or server connection is necessary for exploitation. The vulnerability affects multiple version ranges of the PHP Driver.

An unauthenticated attacker can cause denial of service by terminating the PHP worker or cause data corruption by omitting fields in BSON documents during encoding. This impacts availability and data integrity of applications using the affected MongoDB PHP Driver versions. No authentication or database connection is required, increasing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid encoding unusually large data structures or implement application-level size checks to prevent triggering the vulnerability.