CVE-2026-106432 is a low severity heap buffer overflow (CVSS 3.6) in the BSON encoder of the MongoDB PHP Driver. It needs a non-default configuration that allows multi-gigabyte values. The MongoDB Jira issue lists fix versions 1.21.11, 2.1.11 and 2.5.4, so move to the release in your line.
What's affected
The record names the MongoDB PHP driver but lists no version ranges. The MongoDB Jira issue PHPC-2741, which we fetched, shows a resolution of Fixed, Fix Version/s 1.21.11, 2.1.11 and 2.5.4, and Affects Version/s left empty. We cannot say from those sources which earlier versions are affected, so treat every release before the fixed one in your line as in scope and confirm in the driver release notes.
The record explains the trigger. The encoder converts a string length to a 32 bit value without checking it. When a string is close to 4 GiB, the size used for the allocation can wrap around while the copy uses the original length, which writes past the buffer. The weakness class is CWE-681, incorrect conversion between numeric types.
The vector is local, high complexity, low privileges, with low integrity and availability impact. The record says no MongoDB server interaction is required, and reaching the bug requires a runtime configuration that permits multi-gigabyte values. A default PHP configuration does not.
How to check if you're exposed
Find the version of the extension you are running:
php --ri mongodb
pecl list | grep mongodb
The first command prints the extension details and version. The second works if you installed through PECL. Compare the version with the fixed releases for your line: 1.21.11, 2.1.11 or 2.5.4.
Then check the setting that matters. Look at the memory_limit value in your PHP configuration, because the record says the issue needs a configuration that allows multi-gigabyte values:
php -i | grep memory_limit
A limit of a few hundred megabytes makes it very hard to build a string anywhere near 4 GiB inside one request. If you run command line workers with unlimited memory for batch jobs, look at those first.
What to do now
- Update the MongoDB PHP extension to the fixed version in your release line: 1.21.11, 2.1.11 or 2.5.4.
- Rebuild or reinstall in your container images and confirm the version with the commands above.
- Keep
memory_limitat a sensible number for web requests and avoid unlimited memory for any worker that handles untrusted data. - Cap the size of strings and files your application accepts before it reaches the encoder.
- Check the Jira issue and the driver release notes for any further guidance.
Why it matters
Integer width problems are a classic cause of memory corruption. A length is stored in a wide type, narrowed to a smaller one for the library call, and the two disagree when the value is large. One number sizes the buffer and another sizes the copy, and the gap between them is where memory gets overwritten.
The score is low because exploitation is hard: the attacker must be able to feed a nearly 4 GiB string through an unusual configuration, with local access and some privileges. The Jira issue also lists several other places in the encoder where lengths are narrowed without a check and describes the work as hardening. That is a reminder that the fix is broader than one line. The record does not flag the CVE as known exploited.
Quick check
Does this need a MongoDB server?
No. The record says no server interaction is required, because the problem is in encoding values inside the PHP process.
Is the default PHP configuration affected?
The record says reaching the issue requires a non-default configuration that permits multi-gigabyte values.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
