5.3Mittel
CVE-2026-84968Heap out-of-bounds read via corrupt nested BSON in field path error message
Beschreibung
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
Schwachstellentyp (CWE):
CWE-125
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| MongoDB | PHP Driver | 1.15.0 – < 1.21.8, 2.0.0 – < 2.1.9, 2.2.0 – < 2.5.1 |
Referenzen und Patches
- https://jira.mongodb.org/browse/PHPC-2744 Vendor Advisory
CPE-Treffer (NVD) (3)
cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*≥ 1.15.0 < 1.21.9cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*≥ 2.0.0 < 2.1.9cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*≥ 2.2.0 < 2.5.2