MongoDB PHP Driver CVE-2026-106436

The affected application must accept attacker-influenced data and pass it to the MongoDB PHP driver's BSON encoder such that the resulting document exceeds libbson's size limit (the BSON document maximum, nominally ~16MB). No MongoDB server connection and no database authentication are required (PR:N confirmed), so any network-reachable code path that encodes attacker-controlled data into BSON is exposed. Limiting factors: the attacker needs to be able to make the encoded structure 'unusually large' (reflected by AT:P), which depends on the application exposing an input path that reaches encoding without a prior size cap; applications that validate or bound input size before encoding, or that never encode untrusted data, are not realistically exploitable.

This is a genuine but moderate-priority issue, consistent with its 6.3 MEDIUM CVSS 4.0 score. The vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms network-reachable, unauthenticated triggering, which raises exposure, but the AT:P (Attack Requirements: Present) metric and the description's precondition - the attacker must cause the application to encode an 'unusually large data structure' exceeding libbson's size limit - materially constrain reliable exploitation. Impact is limited to VI:L/VA:L (partial integrity and availability): either a terminated PHP worker (localized DoS) or a silently truncated BSON document with omitted fields; there is NO confidentiality impact (VC:N), despite the 'Information Disclosure' tag. On the exploitation-status axis there is no public exploit identified at time of analysis and no CISA KEV listing, and no EPSS score was provided in the input - so there is no evidence of active or at-scale exploitation. SSVC-style reading: exploitation=none observed, automatable likely no (requires application-specific data flows that reach the encoder with oversized input), technical impact=partial. Net: a real correctness/robustness bug worth patching in affected deployments, not an emergency. The main conflict to note is the 'Information Disclosure' tag versus the CVSS impact metrics, which show integrity/availability rather than confidentiality harm.

An unauthenticated attacker submits an oversized or deeply nested payload (for example a large array via a public HTTP API) to a PHP application that uses the MongoDB PHP driver to BSON-encode that data. Because the encoder does not check return values once the document exceeds libbson's size limit, it enters an invalid state, crashing the PHP worker (denial of service) or producing a document that silently drops fields (data integrity loss). No public proof-of-concept exploit is identified at time of analysis.