MongoDB PHP Driver Stack Exhaustion Vulnerability Allowing Application Crashes

A stack exhaustion vulnerability has been identified in the MongoDB PHP driver, specifically in versions 1.21.5 and 2.1.8. This vulnerability can lead to application crashes when the driver processes deeply nested BSON documents, particularly when these documents originate from sources other than MongoDB Server. The absence of a nesting limit in the PHP driver allows for the possibility of such stack exhaustion, as libbson enforces a maximum nesting level of 100.

Impact

Exploitation of this vulnerability can cause application crashes due to stack exhaustion, disrupting normal operation and potentially leading to denial of service.

Remediation

Users can update to MongoDB PHP Driver versions 1.21.5 or 2.1.8, where this vulnerability has been addressed.