MongoDB PHP Driver
5 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-106436 | 1.3.0 – < 1.21.11 ; 2.0.0 – < 2.1.11 ; 2.2.0 – < 2.5.4 | Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-106432 | 1.16.0 – < 1.21.11 ; 2.0.0 – < 2.1.11 ; 2.2.0 – < 2.5.4 | Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver | LOW 2.0 | 0.2 % | ||
| CVE-2026-96745 | < 1.21.10 ; 2.0.0 – < 2.1.10 ; 2.2.0 – < 2.5.3 | PHP object injection via unsuppressible __pclass class inference in command monitoring events | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-84968 | 1.15.0 – < 1.21.8 ; 2.0.0 – < 2.1.9 ; 2.2.0 – < 2.5.1 | Heap out-of-bounds read via corrupt nested BSON in field path error message | MEDIUM 6.9 | 0.2 % | ||
| CVE-2025-12119 | ≤ 2.1.2 | Bulk write with options may read invalid memory | MEDIUM 6.9 | 0.2 % |