Source: php-mongodb Version: 2.5.3-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for php-mongodb. CVE-2026-106432[0]: | The BSON encoder in the MongoDB PHP Driver converts a string length | to a 32-bit value without validation. When an affected application | encodes a string near 4 GiB, the allocation size can wrap while the | copy operation uses the original length. The resulting heap buffer | overflow can corrupt process memory or terminate the PHP process. | Reaching this issue requires a non-default runtime configuration | that permits multi-gigabyte values. No MongoDB server interaction is | required. CVE-2026-106436[1]: | The BSON encoder in the MongoDB PHP Driver does not check some | return values after a document exceeds libbson's size limit. This | can leave the encoder in an invalid state. An unauthenticated actor | who can cause an affected application to encode an unusually large | data structure can terminate the PHP worker or cause the resulting | document to omit fields. No MongoDB server connection or database | authentication is required. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-106432 https://www.cve.org/CVERecord?id=CVE-2026-106432 https://jira.mongodb.org/browse/PHPC-2741 [1] https://security-tracker.debian.org/tracker/CVE-2026-106436 https://www.cve.org/CVERecord?id=CVE-2026-106436 https://jira.mongodb.org/browse/PHPC-2739 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
