CVE-2026-112368— Unbounded Recursion in phongo_bson_visit_document/visit_array:
Quick assessment
Affected
MongoDB Inc. PHP Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB PHP 驱动程序在 BSON 解码逻辑中存在不受控的递归缺陷，可能导致未认证的攻击者通过向解码器提供特制的二进制文档数据，耗尽进程栈空间。这将导致使用该驱动程序的 PHP 进程意外终止，进而造成该进程服务不可用。该问题发生在 PHP 层之下，无法通过应用层的错误处理机制进行拦截。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB Inc. | PHP Driver | 1.0.0< 1.21.12 |
affected |
2.1.0< 2.1.12 |
affected | ||
2.5.0< 2.5.5 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112368
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unbounded Recursion in phongo_bson_visit_document/visit_array:
Source: CVE Program / CVE List V5
Vulnerability Description
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB Inc. | PHP Driver | 1.0.0 ~ 1.21.12 | - |
|
II. Public POCs for CVE-2026-112368
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112368
请登录查看更多情报信息。
Other References for CVE-2026-112368 (1)
IV. Related Vulnerabilities
Same product: PHP Driver
-
CVE-2026-106436
Application denial of service and data truncation via unchec -
CVE-2026-106432
Heap buffer overflow via 32-bit string-length truncation in -
CVE-2026-96745
PHP object injection via unsuppressible __pclass class infer -
CVE-2026-84968
Heap out-of-bounds read via corrupt nested BSON in field pat -
CVE-2026-6811
PHP Stack Exhaustion
Same vendor: MongoDB Inc.
-
CVE-2026-93759
Server-side JavaScript injection via string query criteria b -
CVE-2026-93760
NoSQL injection of JavaScript-executing query operators via -
CVE-2026-93761
Denial of service via unbounded regex matching in Mongoid's -
CVE-2026-93762
Data deletion and attribute disclosure via field-name method -
CVE-2026-93763
Silent plaintext persistence via unresolved callable databas
Same weakness: CWE-674
-
CVE-2026-110673
Cpanel::JSON::XS versions before 4.80 for Perl allow stack e -
CVE-2026-8168
Denial-of-service vulnerability in the SVG parser and render -
CVE-2026-111923
Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enroll -
CVE-2026-55862
pupnp: Incomplete fix for CVE-2021-28302: recursive DOM func -
CVE-2026-100354
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/
V. Comments for CVE-2026-112368
No comments yet