CVE-2026-106432 — Php Driver
LOWCVE-2026-106432 is a low-severity (CVSS 3.6) CWE-681 vulnerability in mongodb php driver. A fix is available — see the affected versions and patch details below.
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size…
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-106432.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-106432 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 389,824 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Description
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.
Affected Products
php drivermongodbDetection & mitigation playbook
Vendor / applianceDetect
Inventory every mongodb php driver deployment and check each version against the affected-products list above.
Fix
Apply the mongodb php driver security patch or hotfix for CVE-2026-106432 on the affected version, following the vendor advisory for your exact build.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Low severity is assigned because exploitation requires local access, a non-default PHP runtime configuration permitting multi-gigabyte memory allocations, and encoding a string near four gigabytes through the BSON encoder. In Red Hat environments, the affected MongoDB driver extension is not provided in core Red Hat…
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.Source: Red Hat security advisory for CVE-2026-106432 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-106432 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.