{"id":"CVE-2026-6811","state":"PUBLISHED","title":"PHP Stack Exhaustion","description":"Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.","publishedAt":"2026-05-14T21:27:03.862Z","updatedAt":"2026-05-15T13:30:08.302Z","severity":{"score":6,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"mongodb"},"assigner":"mongodb","products":["MongoDB Inc. PHP Driver"],"affected":[{"vendor":"MongoDB Inc.","product":"PHP Driver","defaultStatus":"unaffected","versions":[{"version":"1.21.5","status":"affected","versionType":"semver"},{"version":"2.1.8","status":"affected","versionType":"semver"}]}],"references":["https://jira.mongodb.org/browse/PHPC-2636"],"weaknesses":["CWE-674"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/6xxx/CVE-2026-6811.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-6811","state":"PUBLISHED","datePublished":"2026-05-14T21:27:03.862Z","dateUpdated":"2026-05-15T13:30:08.302Z","assignerShortName":"mongodb","assignerOrgId":"a39b4221-9bd0-4244-95fc-f3e2e07f1deb","dateReserved":"2026-04-21T17:34:55.192Z"},"containers":{"cna":{"title":"PHP Stack Exhaustion","descriptions":[{"lang":"en","value":"Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server."}],"affected":[{"vendor":"MongoDB Inc.","product":"PHP Driver","defaultStatus":"unaffected","versions":[{"version":"1.21.5","status":"affected","versionType":"semver"},{"version":"2.1.8","status":"affected","versionType":"semver"}]}],"references":[{"url":"https://jira.mongodb.org/browse/PHPC-2636"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseSeverity":"MEDIUM","baseScore":5.9,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-674","lang":"en","description":"CWE-674 Uncontrolled Recursion","type":"CWE"}]}],"providerMetadata":{"shortName":"mongodb","orgId":"a39b4221-9bd0-4244-95fc-f3e2e07f1deb","dateUpdated":"2026-05-14T21:27:03.862Z"},"impacts":[{"capecId":"CAPEC-230","descriptions":[{"lang":"en","value":"CAPEC-230 Serialized Data with Nested Payloads"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-15T13:22:29.267942Z","id":"CVE-2026-6811","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-15T13:30:08.302Z"}}]}}}