PatchTheCVEphp driver vulnerabilities and fixes
Recent CVEs affecting php driver, with upgrade or downgrade steps. 3 tracked.
Also searched as: phpdriver.
php driver has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-10-08. Highest priority: CVE-2026-6811 (score 33/100).
- CVE-2026-6811 MEDIUM 5.9 UPGRADE Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply
- CVE-2026-106436 MEDIUM 4.8 UPGRADE The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson'
- CVE-2026-106432 LOW 3.6 UPGRADE The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation
FAQ
How do I fix php driver vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is php driver being exploited right now?
None of the tracked php driver CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which php driver CVE should I patch first?
CVE-2026-6811 currently ranks highest (33/100): Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply .