CVE record · 1 source
CVE-2026-106432
CVSS 3.6The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation.
- Vendor
- MongoDB
- Product
- MongoDB
- CVSS
- 3.6
- Exposure class
- Database
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation.
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the…