CVE-2026-112368: MongoDB PHP Driver DOS Vulnerability

CVE-2026-112368 Overview

CVE-2026-112368 is an uncontrolled recursion weakness in the Binary JSON (BSON) decoding logic of the MongoDB PHP driver. An unauthenticated attacker who can supply crafted binary document data to the decoder can exhaust the process stack. The condition terminates the PHP process using the driver, causing a loss of availability. Because the fault occurs below the PHP layer, application-level try/catch handlers cannot intercept it. The weakness is classified under CWE-674: Uncontrolled Recursion and is tracked in the vendor issue MongoDB PHPC-276.

Critical Impact
A single crafted BSON payload can crash any PHP process that decodes it, enabling a repeatable denial-of-service against web applications and background workers that consume MongoDB data from untrusted sources.

Affected Products

MongoDB PHP driver (BSON decoding component)
PHP applications linking the affected driver extension
Services ingesting BSON documents from untrusted or network-reachable sources

Discovery Timeline

2026-10-19 - CVE-2026-112368 published to the National Vulnerability Database (NVD)
2026-10-20 - Last updated in the NVD database

Technical Details for CVE-2026-112368

Vulnerability Analysis

The MongoDB PHP driver parses BSON documents through a recursive decoding routine. BSON supports nested document and array types, and each nested element causes the decoder to call itself to parse the embedded sub-document. The implementation does not enforce a maximum recursion depth. An attacker crafts a BSON payload containing deeply nested sub-documents, forcing the decoder to recurse until the native thread stack is exhausted. The resulting stack overflow aborts the PHP process rather than raising a catchable error, because the failure occurs inside the C-level extension.

Availability is the sole impact. The flaw does not corrupt memory in a way that permits code execution, and it does not leak data. However, repeated exploitation sustains a denial-of-service against any component that decodes attacker-influenced BSON.

Root Cause

The root cause is missing depth tracking in the recursive BSON walker. BSON structural recursion is bounded only by payload size, not by nesting depth, so a compact document can describe thousands of nested levels. Without a depth counter and threshold check, the parser mirrors the input structure directly onto the call stack.

Attack Vector

Exploitation requires no authentication and no user interaction. Any ingress point that passes attacker-controlled bytes to the driver's BSON decoder is reachable: HTTP endpoints that forward binary payloads to MongoDB, queue consumers processing BSON messages, or replication and change-stream handlers consuming untrusted data. A single malformed document per request is sufficient to terminate the worker.

No verified public exploit code was available at publication. See the MongoDB JIRA PHPC-276 issue for vendor technical details.

Detection Methods for CVE-2026-112368

Indicators of Compromise

Abrupt PHP-FPM or CLI worker termination with SIGSEGV or stack-overflow signatures in system logs without a corresponding PHP exception trace.
Spikes in HTTP 502 or 504 responses from endpoints that accept binary payloads bound for MongoDB.
Inbound requests carrying BSON documents with abnormally deep nesting or disproportionately small payload size relative to element count.

Detection Strategies

Inspect pre-parse BSON payloads at the application boundary and reject documents whose declared nesting depth exceeds an operational threshold.
Correlate PHP worker crashes with the request IDs that preceded them to identify malicious payload patterns.
Alert on repeated process restarts of PHP workers that embed the MongoDB driver, especially when restarts cluster around a single client IP.

Monitoring Recommendations

Forward PHP-FPM, systemd, and kernel logs to a centralized log platform and build an identification rule for stack-exhaustion signals.
Track MongoDB driver crash counts per host as a service-health metric and page on sustained increases.
Monitor web application firewall (WAF) telemetry for binary POST bodies exceeding expected size or depth profiles.

How to Mitigate CVE-2026-112368

Immediate Actions Required

Inventory all PHP services that load the MongoDB driver extension and identify which accept BSON from untrusted sources.
Apply the fixed MongoDB PHP driver release referenced in PHPC-276 as soon as the patched version is available in your package channel.
Restrict network exposure of endpoints that forward raw BSON to the driver until the patch is deployed.

Patch Information

Refer to the vendor tracking issue MongoDB JIRA PHPC-276 for the fixed driver version and upgrade instructions. Rebuild or reinstall the PECL mongodb extension after upgrading, and restart PHP-FPM and any long-running CLI workers to load the patched library.

Workarounds

Terminate client connections at a reverse proxy and enforce a maximum request body size that cannot embed deeply nested BSON.
Validate inbound documents with a lightweight pre-parser that counts nesting depth and rejects payloads above a safe limit, for example 100 levels.
Isolate BSON-consuming workers in dedicated process pools so a crash does not affect unrelated services, and configure the process manager to restart them quickly.

bash

# Example PHP-FPM pool hardening to limit blast radius
; /etc/php/php-fpm.d/mongo-worker.conf
[mongo-worker]
user = www-data
pm = dynamic
pm.max_children = 20
pm.max_requests = 500
request_terminate_timeout = 10s
; Restart child on abnormal exit
process.priority = 0
catch_workers_output = yes