CVE-Katalog
CVE-2026-6811
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is
- Schweregrad
- Medium · CVSS 6
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.37% · Oct 23, 2026
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | php-mongodb | sid | 2.5.3-1 | fixed |
| Debian | php-mongodb | forky | 2.5.3-1 | fixed |
| Debian | php-mongodb | trixie | 2.0.0-1 | vulnerable |
| Debian | php-mongodb | trixie-security | 2.0.0-1+deb13u1 | fixed |
| Debian | php-mongodb | bookworm | 1.15.0+1.11.1+1.9.2+1.7.5-1 | vulnerable |
| Cpe | php-mongodb | Not reported | Not reported | vulnerable |
| Cpe | php_driver | Not reported | 2.1.8 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | php-mongodb | source | sid | 2.5.3-1 | not yet assigned | Not reported | [1136802] |
| Debian | php-mongodb | source | forky | 2.5.3-1 | not yet assigned | Not reported | [1136802] |
| Debian | php-mongodb | source | trixie | 2.0.0-1+deb13u1 | not yet assigned | Not reported | [1136802] |
| Debian | php-mongodb | source | bookworm | (unfixed) | not yet assigned | Not reported | [1136802] |
| Cpe | php_driver | cpe | Not reported | 2.1.8 | Not reported | NVD-CVE-2026-6811 | Not reported |
Notes
[bookworm] php-mongodb: Minor issue
OpenFactory catalog packages
Die Paketzuordnung läuft.
[Debian 12 (Bookworm)]
- [php8.2-mongodb]Unbekannt
Quellpaket: [php-mongodb]
Details (2)
1.15.0+1.11.1+1.9.2+1.7.5-1· amd64 · bookwormBetroffen
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
1.15.0+1.11.1+1.9.2+1.7.5-1· arm64 · bookwormBetroffen
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
- [php-mongodb]Unbekannt
Details (2)
1.15.0+1.11.1+1.9.2+1.7.5-1· amd64 · bookwormBetroffen
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
1.15.0+1.11.1+1.9.2+1.7.5-1· arm64 · bookwormBetroffen
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
- [php-mongodb-all-dev]Unbekannt
Quellpaket: [php-mongodb]
Details (2)
1.15.0+1.11.1+1.9.2+1.7.5-1· all · bookwormBetroffen
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
1.15.0+1.11.1+1.9.2+1.7.5-1· all · bookwormBetroffen
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
[Debian 13 (Trixie)]
- [php8.4-mongodb]Unbekannt
Quellpaket: [php-mongodb]
Details (3)
2.0.0-1· amd64 · trixieBetroffen · Behoben:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1· arm64 · trixieBetroffen · Behoben:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1+deb13u1· amd64 · trixie-securityBehoben · Behoben:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
- [php-mongodb]Unbekannt
Details (3)
2.0.0-1· all · trixieBetroffen · Behoben:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1· all · trixieBetroffen · Behoben:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1+deb13u1· all · trixie-securityBehoben · Behoben:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
- [php-mongodb-all-dev]Unbekannt
Quellpaket: [php-mongodb]
Details (3)
2.0.0-1· all · trixieBetroffen · Behoben:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1· all · trixieBetroffen · Behoben:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1+deb13u1· all · trixie-securityBehoben · Behoben:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
Beobachtet:
Referenzen
- [https://nvd.nist.gov/vuln/detail/CVE-2026-6811]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-6811]
- [https://security-tracker.debian.org/tracker/CVE-2026-6811]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1562.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]