MongoDB PHP Driver CVE-2026-6811

Q: What is the CVSS score of CVE-2026-6811?

CVE-2026-6811 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30490 MEDIUM

Uncontrolled Recursion (CWE-674)

2026-05-14 mongodb

GHSA-vc69-vr6f-4x67

Denial Of Service PHP

6.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

May 14, 2026 - 22:22 NVD

5.9 (MEDIUM) 6.0 (MEDIUM)

Analysis Generated

May 14, 2026 - 22:15 vuln.today

CVE Published

May 14, 2026 - 21:27 nvd

MEDIUM 5.9

DescriptionCVE.org

Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

AnalysisAI

Stack exhaustion in MongoDB PHP driver allows remote denial of service when processing deeply nested BSON documents from untrusted sources. Unauthenticated attackers can crash applications by sending maliciously crafted BSON payloads with excessive nesting levels, affecting all versions of the PHP driver that parse BSON without depth limits. The vulnerability requires high attack complexity but results in complete availability loss.

Technical ContextAI

The MongoDB PHP driver (mongodb/mongodb library) parses BSON (Binary JSON) documents, a binary serialization format used by MongoDB. The vulnerability exists in the BSON parser's recursive deserialization logic, which does not enforce reasonable depth limits when processing nested documents and arrays. CWE-674 (Uncontrolled Recursion) indicates the root cause: the parser follows object references recursively without safeguards, exhausting the PHP process stack when given adversarial input. This is particularly dangerous when the BSON source is not a trusted MongoDB Server instance but rather user-supplied data or data from untrusted APIs, removing the implicit validation that would normally occur in client-server communication.

RemediationAI

Upgrade MongoDB PHP driver to the patched version once released by MongoDB Inc.; check MongoDB JIRA ticket PHPC-2636 for patch availability and release notes. Until patching is possible, implement input validation to reject BSON documents exceeding a reasonable nesting depth (e.g., maximum 20 levels) before passing to the driver parser-this mitigates the attack vector from untrusted sources while preserving normal MongoDB communication. Additionally, configure PHP's max_execution_time and memory_limit conservatively to limit impact of any stack exhaustion event. If BSON processing is not a core requirement, disable BSON parsing features or restrict BSON input to MongoDB Server responses only, rejecting externally sourced BSON entirely.