CVE-2026-112368: CWE-674: Uncontrolled Recursion in MongoDB Inc. PHP Driver
Description
CVE-2026-112368 is a high-severity vulnerability in the MongoDB PHP driver involving uncontrolled recursion in BSON decoding. An unauthenticated attacker supplying crafted binary document data can cause the PHP process to terminate unexpectedly due to stack exhaustion. This denial of service occurs beneath the PHP layer and cannot be caught by application-level error handling.
CVSS v4.0
Score 8.2high
Affected software
MongoDB Inc.
PHP Driver
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from uncontrolled recursion in the BSON decoding logic of the MongoDB PHP driver. When processing maliciously crafted binary document data, the decoder may exhaust the process stack, causing the PHP process to crash. The flaw affects multiple version ranges of the PHP driver and leads to loss of availability. The issue is exploitable without authentication and does not require user interaction. The vulnerability is identified as CWE-674 (Uncontrolled Recursion).
Potential Impact
An unauthenticated attacker can cause a denial of service by crashing the PHP process using the vulnerable MongoDB PHP driver. This results in loss of availability for applications relying on the driver. The crash occurs below the PHP layer, making it impossible for application-level error handling to mitigate the impact.
Mitigation Recommendations
No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-10-19T15:43:27.356Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad63f762cdf04f65669a35c
Added to database: 10/19/2026, 16:04:06 UTC
Last enriched: 10/19/2026, 16:18:16 UTC
Last updated: 10/19/2026, 16:19:17 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.