Php Driver
Monthly
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Encoding an oversized document with the MongoDB PHP Driver can leave the BSON encoder in an invalid state because libbson size-limit return values are not checked, allowing an unauthenticated remote actor to terminate PHP workers or cause fields to be omitted from the serialized document when an application encodes attacker-influenced data that exceeds the BSON size limit. The affected component is the MongoDB PHP Driver (mongodb:php_driver), and no MongoDB server connection or database authentication is required because the failure occurs during client-side BSON encoding. Exploitation is limited to applications that accept attacker-influenced data and pass it to the encoder without a prior size cap; this is a genuine but moderate-priority issue consistent with its 6.3 MEDIUM CVSS 4.0 score, and no public exploit was identified at time of analysis.
Heap buffer overflow in the MongoDB PHP Driver's BSON encoder can corrupt process memory or crash the PHP process when an application encodes a string near 4 GiB under a non-default runtime configuration that permits multi-gigabyte values. The vulnerability requires local access (AV:L) and low privileges (PR:L), and per the independent assessment, exploitation hinges on a specific attack requirement (AT:P) - the enabling configuration - making real-world risk low. No public exploit code or active exploitation (KEV) has been identified at time of analysis. The CVSS 4.0 base score is 2.0, and the independent CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) confirms limited impact (low integrity and availability) with no confidentiality loss.
Deserialization of untrusted document content in the MongoDB PHP Driver (CWE-502) lets class names embedded in a field such as __pclass be honored when the driver constructs command-monitoring event objects, so an unauthenticated party who controls data flowing into a database operation can cause an application class implementing the driver's persistable interface to be instantiated and have its unserialization method invoked. The flaw only bites applications that (1) register a command monitoring subscriber and (2) pass attacker-controlled data into an operation reflected in monitoring events; impact ranges from benign to severe depending on which gadget classes exist in the deployment, which is why the vendor rates it 6.3 (CVSS 4.0, AV:N/AC:H/PR:N/UI:N/VC:L/VI:L/VA:L) and our independent assessment lands at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. No public exploit code or confirmed active exploitation has been identified at time of analysis; vendor-released patches are available in driver versions 1.21.10, 2.1.10 and 2.5.3.
Out-of-bounds read in the BSON decoding component of the MongoDB PHP Driver (all versions per CPE cpe:2.3:a:mongodb:php_driver) allows an unauthenticated remote party to cause a small quantity of adjacent process memory to be copied into an error message that is returned to application code. The disclosure is limited in scope - only a few bytes of process memory are exposed, and they surface in application-level error messages rather than being sent directly in a network response - but may inadvertently reveal stack variables, pointers, or partial secrets depending on memory layout. No public exploit code has been identified at time of analysis.
Stack exhaustion in MongoDB PHP driver allows remote denial of service when processing deeply nested BSON documents from untrusted sources. Unauthenticated attackers can crash applications by sending maliciously crafted BSON payloads with excessive nesting levels, affecting all versions of the PHP driver that parse BSON without depth limits. The vulnerability requires high attack complexity but results in complete availability loss.
A mongoc_bulk_operation_t may read invalid memory if large options are passed. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Encoding an oversized document with the MongoDB PHP Driver can leave the BSON encoder in an invalid state because libbson size-limit return values are not checked, allowing an unauthenticated remote actor to terminate PHP workers or cause fields to be omitted from the serialized document when an application encodes attacker-influenced data that exceeds the BSON size limit. The affected component is the MongoDB PHP Driver (mongodb:php_driver), and no MongoDB server connection or database authentication is required because the failure occurs during client-side BSON encoding. Exploitation is limited to applications that accept attacker-influenced data and pass it to the encoder without a prior size cap; this is a genuine but moderate-priority issue consistent with its 6.3 MEDIUM CVSS 4.0 score, and no public exploit was identified at time of analysis.
Heap buffer overflow in the MongoDB PHP Driver's BSON encoder can corrupt process memory or crash the PHP process when an application encodes a string near 4 GiB under a non-default runtime configuration that permits multi-gigabyte values. The vulnerability requires local access (AV:L) and low privileges (PR:L), and per the independent assessment, exploitation hinges on a specific attack requirement (AT:P) - the enabling configuration - making real-world risk low. No public exploit code or active exploitation (KEV) has been identified at time of analysis. The CVSS 4.0 base score is 2.0, and the independent CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) confirms limited impact (low integrity and availability) with no confidentiality loss.
Deserialization of untrusted document content in the MongoDB PHP Driver (CWE-502) lets class names embedded in a field such as __pclass be honored when the driver constructs command-monitoring event objects, so an unauthenticated party who controls data flowing into a database operation can cause an application class implementing the driver's persistable interface to be instantiated and have its unserialization method invoked. The flaw only bites applications that (1) register a command monitoring subscriber and (2) pass attacker-controlled data into an operation reflected in monitoring events; impact ranges from benign to severe depending on which gadget classes exist in the deployment, which is why the vendor rates it 6.3 (CVSS 4.0, AV:N/AC:H/PR:N/UI:N/VC:L/VI:L/VA:L) and our independent assessment lands at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. No public exploit code or confirmed active exploitation has been identified at time of analysis; vendor-released patches are available in driver versions 1.21.10, 2.1.10 and 2.5.3.
Out-of-bounds read in the BSON decoding component of the MongoDB PHP Driver (all versions per CPE cpe:2.3:a:mongodb:php_driver) allows an unauthenticated remote party to cause a small quantity of adjacent process memory to be copied into an error message that is returned to application code. The disclosure is limited in scope - only a few bytes of process memory are exposed, and they surface in application-level error messages rather than being sent directly in a network response - but may inadvertently reveal stack variables, pointers, or partial secrets depending on memory layout. No public exploit code has been identified at time of analysis.
Stack exhaustion in MongoDB PHP driver allows remote denial of service when processing deeply nested BSON documents from untrusted sources. Unauthenticated attackers can crash applications by sending maliciously crafted BSON payloads with excessive nesting levels, affecting all versions of the PHP driver that parse BSON without depth limits. The vulnerability requires high attack complexity but results in complete availability loss.
A mongoc_bulk_operation_t may read invalid memory if large options are passed. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.