CVE-2026-106432

A heap buffer overflow exists in the MongoDB PHP Driver due to the BSON encoder converting string lengths to 32-bit values without validation. When an application encodes a string near 4 GiB , the allocation size can wrap while the copy operation uses the original length, potentially corrupting p...

CVE-2026-106436

The MongoDB PHP Driver contains a vulnerability in its BSON encoder caused by unchecked return values when a document exceeds the libbson size limit. This flaw can leave the encoder in an invalid state, allowing an unauthenticated actor to trigger a denial of service by terminating the PHP worker...