{"id":"CVE-2026-112368","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-112368","generatedAt":"2026-10-28T02:57:06.005Z","title":"An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack.","description":"An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.","published":"2026-10-19T16:17:08.000Z","lastModified":"2026-10-20T20:17:16.000Z","status":"Awaiting Analysis","sourceIdentifier":"cna@mongodb.com","cvss":{"version":"4.0","score":8.2,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-674"],"affected":[],"epss":{"score":0.00263,"percentile":0.17973,"date":"2026-10-26","history":[{"date":"2026-10-20","score":0.00263,"percentile":0.17001}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-19T16:17:08.000Z","detail":{"score":"8.2","severity":"HIGH","publishedAt":"2026-10-19T16:17:07.650Z"},"summary":"New CVE, high severity (CVSS 8.2)."}],"references":[{"url":"https://jira.mongodb.org/browse/PHPC-276","source":"cna@mongodb.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-112368","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}