The vulnerability is a stack exhaustion flaw in the MongoDB PHP driver that can cause applications to crash when they handle deeply nested BSON documents originating from sources other than a MongoDB Server. This flaw leads to denial of service by exhausting stack resources, potentially bringing down web services or other PHP applications that process untrusted data. The weakness is classified as CWE‑674, a stack overflow. The impact is limited to application failure rather than unauthorized code execution or data disclosure.

The flaw affects the MongoDB Inc. PHP Driver. No specific driver versions are listed, so any installation of the driver that has not been updated after the discovery of this issue may be vulnerable. System administrators should verify the driver version against the vendor’s release notes for a fix.

The CVSS score of 6.0 indicates a moderate severity. The EPSS score is currently unavailable, so the exact likelihood of exploitation cannot be quantified. The flaw is not listed in CISA’s KEV catalog. The attack vector is inferred: an attacker would need to send specially crafted BSON documents—such as via a web form or API endpoint—to a PHP application using the driver. The source document must come from an external, non‑MongoDB Server to trigger the overflow. Once processed by the driver, the stack exhaustion would terminate the PHP process, resulting in a denial of service.