Catalogo CVE
CVE-2026-84968
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory
- Gravità
- Medium · CVSS 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.20% · Oct 23, 2026
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | php-mongodb | sid | 2.5.3-1 | fixed |
| Debian | php-mongodb | forky | 2.5.3-1 | fixed |
| Debian | php-mongodb | trixie | 2.0.0-1 | vulnerable |
| Debian | php-mongodb | trixie-security | 2.0.0-1+deb13u1 | fixed |
| Debian | php-mongodb | bookworm | 1.15.0+1.11.1+1.9.2+1.7.5-1 | vulnerable |
| Cpe | php_driver | Not reported | 2.5.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | php-mongodb | source | sid | 2.5.3-1 | not yet assigned | Not reported | [1149050] |
| Debian | php-mongodb | source | forky | 2.5.3-1 | not yet assigned | Not reported | [1149050] |
| Debian | php-mongodb | source | trixie | 2.0.0-1+deb13u1 | not yet assigned | Not reported | [1149050] |
| Debian | php-mongodb | source | bookworm | (unfixed) | not yet assigned | Not reported | [1149050] |
| Cpe | php_driver | cpe | Not reported | 2.5.2 | Not reported | NVD-CVE-2026-84968 | Not reported |
Notes
[bookworm] php-mongodb: Minor issue, infoleak
OpenFactory catalog packages
L’associazione dei pacchetti è in corso.
[Debian 12 (Bookworm)]
- [php8.2-mongodb]Sconosciuto
Pacchetto sorgente: [php-mongodb]
Dettagli (2)
1.15.0+1.11.1+1.9.2+1.7.5-1· amd64 · bookwormInteressata
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
1.15.0+1.11.1+1.9.2+1.7.5-1· arm64 · bookwormInteressata
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
- [php-mongodb]Sconosciuto
Dettagli (2)
1.15.0+1.11.1+1.9.2+1.7.5-1· amd64 · bookwormInteressata
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
1.15.0+1.11.1+1.9.2+1.7.5-1· arm64 · bookwormInteressata
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
- [php-mongodb-all-dev]Sconosciuto
Pacchetto sorgente: [php-mongodb]
Dettagli (2)
1.15.0+1.11.1+1.9.2+1.7.5-1· all · bookwormInteressata
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
1.15.0+1.11.1+1.9.2+1.7.5-1· all · bookwormInteressata
nvd · php-mongodb · debian · bookworm; nvd · php-mongodb · debian · 12
[Debian 13 (Trixie)]
- [php8.4-mongodb]Sconosciuto
Pacchetto sorgente: [php-mongodb]
Dettagli (3)
2.0.0-1· amd64 · trixieInteressata · Corretta:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1· arm64 · trixieInteressata · Corretta:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1+deb13u1· amd64 · trixie-securityCorretta · Corretta:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
- [php-mongodb]Sconosciuto
Dettagli (3)
2.0.0-1· all · trixieInteressata · Corretta:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1· all · trixieInteressata · Corretta:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1+deb13u1· all · trixie-securityCorretta · Corretta:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
- [php-mongodb-all-dev]Sconosciuto
Pacchetto sorgente: [php-mongodb]
Dettagli (3)
2.0.0-1· all · trixieInteressata · Corretta:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1· all · trixieInteressata · Corretta:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
2.0.0-1+deb13u1· all · trixie-securityCorretta · Corretta:
2.0.0-1+deb13u1nvd · php-mongodb · debian · 13
Osservato:
Riferimenti
- [https://nvd.nist.gov/vuln/detail/CVE-2026-84968]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-84968]
- [https://security-tracker.debian.org/tracker/CVE-2026-84968]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3209.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]