CVE-2026-96745
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A deserialization vulnerability in the command monitoring support of the MongoDB PHP Driver can cause class names from document content to be honored when building monitoring events. An attacker controlling data in database operations may instantiate application classes implementing the persistable interface and invoke their unserialize method.
Risk Assessment
The impact depends on available classes, but could include remote code execution, privilege escalation, or other unauthorized actions, posing a serious security threat.
Recommendation
It is recommended to upgrade the MongoDB PHP Driver to a patched version and avoid processing untrusted data in database operations when a monitoring subscriber is registered.
Other vulnerabilities in MongoDB PHP Driver
See all- CVE-2026-112368High
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process.
- CVE-2026-106436Medium
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
- CVE-2026-106432Low
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. For strings near 4 GiB, allocation can wrap while copy uses original length, causing heap buffer overflow. Requires non-default runtime configuration allowing multi-gigabyte values.
- CVE-2026-84968Medium
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
- CVE-2026-6811Medium
A stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
Original NVD description (English source)
Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS