An uncontrolled recursion flaw exists in the BSON decoding logic of the MongoDB PHP driver. When a crafted binary document containing deeply nested arrays or subdocuments is parsed, the decoder repeatedly calls its visit functions without limiting depth, eventually exhausting the process stack. This causes the PHP process that uses the driver to terminate and cannot be recovered by application‑level error handling. The weakness is classified as CWE-674 (Uncontrolled Recursion). The result is a loss of availability for the affected PHP service.

The vulnerability affects MongoDB Inc.’s PHP Driver for PHP. No specific version information is provided, so all installations that use the driver without the latest patch may be vulnerable.

The vulnerability scores a CVSS of 8.2, indicating high severity. EPSS data are not reported and the flaw is not listed in the CISA KEV catalog. The likely attack vector is delivering crafted BSON data to the PHP driver, most probably over the database connection or through application input, which can trigger stack exhaustion remotely. As the flaw resides below the PHP layer, it bypasses normal application error handling and can be executed without authentication.