Bug 2548221 (CVE-2026-106432)

Summary: CVE-2026-106432 php-pecl-mongodb: php-pecl-mongodb: Denial of Service via heap buffer overflow in BSON encoder
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the MongoDB PHP Driver. In non-default runtime configurations permitting multi-gigabyte values, the BSON (Binary JSON) encoder converts large string lengths without validation, triggering an integer wrap and subsequent heap-based buffer overflow when encoding strings near four gigabytes. A local attacker can exploit this vulnerability to corrupt process memory or terminate the PHP process, leading to a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2548442, 2548443, 2548444    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-08 20:01:47 UTC 
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.