5.3Orta
CVE-2026-84968Heap out-of-bounds read via corrupt nested BSON in field path error message
Açıklama
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
Zayıflık türü (CWE):
CWE-125
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| MongoDB | PHP Driver | 1.15.0 – < 1.21.8, 2.0.0 – < 2.1.9, 2.2.0 – < 2.5.1 |
Kaynaklar ve yamalar
- https://jira.mongodb.org/browse/PHPC-2744 Vendor Advisory
CPE eşleşmeleri (NVD) (3)
cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*≥ 1.15.0 < 1.21.9cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*≥ 2.0.0 < 2.1.9cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*≥ 2.2.0 < 2.5.2