---
id: CVE-2026-6811
title: >-
  Stack exhaustion vulnerability in the MongoDB PHP driver can cause application
  crashes when processing deeply nested BSON documents in unusual circumstances
  when the source of these BSON documents is not MongoDB Server.
summary: >-
  Stack exhaustion vulnerability in the MongoDB PHP driver can cause application
  crashes when processing deeply nested BSON documents in unusual circumstances
  when the source of these BSON documents is not MongoDB Server.
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
vendor: mongodb
product: php_driver
affected:
  - 'php_driver >= 1.21.0, < 1.21.5'
  - 'php_driver >= 2.1.0, < 2.1.8'
patched:
  - php_driver 2.1.8
published: '2026-05-14'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T17:33:34.907'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6811'
references:
  - url: 'https://jira.mongodb.org/browse/PHPC-2636'
    label: cna@mongodb.com
tags:
  - nvd
epss: 0.00416
epssPercentile: 0.33193
ingestedAt: '2026-09-24T17:48:30.379Z'
---

## Overview

Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

## Affected

- `php_driver >= 1.21.0, < 1.21.5`
- `php_driver >= 2.1.0, < 2.1.8`

## Remediation

Upgrade past the affected range:

- `php_driver 2.1.8`