Fluid Attacks Database

Description

Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version
debian 12	php-mongodb	=1.15.0+1.11.1+1.9.2+1.7.5-1 \|\| =1.19.3-1 \|\| =1.19.4-2 \|\| =1.19.4-3~exp2 \|\| =1.19.4-3~exp3 \|\| =1.19.4-3~exp4 \|\| =1.20.0-1 \|\| =1.20.1-1 \|\| =1.21.0-1 \|\| =2.0.0-1 \|\| =2.1.0-1
debian 11	php-mongodb	=1.11.1+1.9.2+1.7.5-4 \|\| =1.12.0+1.9.2+1.7.5-2 \|\| =1.12.0+1.9.2+1.7.5-3 \|\| =1.12.0+1.9.2+1.7.5-4 \|\| =1.15.0+1.11.1+1.9.2+1.7.5-1 \|\| =1.15.0+1.11.1+1.9.2+1.7.5-1~exp3 \|\| =1.19.3-1 \|\| =1.19.4-2 \|\| =1.19.4-3~exp2 \|\| =1.19.4-3~exp3 \|\| =1.19.4-3~exp4 \|\| =1.20.0-1 \|\| =1.20.1-1 \|\| =1.21.0-1 \|\| =1.9.0+1.7.5-2 \|\| =2.0.0-1 \|\| =2.1.0-1
debian 14	php-mongodb	=2.0.0-1 \|\| =2.1.0-1
debian 13	php-mongodb	=2.0.0-1 \|\| =2.1.0-1

Aliases

1. CVE-2026-68112. NVD-2026-68113. OSV-DEBIAN-2026-68114. OSV-2026-68115. SECURITY-TRACKER-CVE-2026-6811