This article was published on October 20, 2026

Preface: AI and Large Language Models (LLMs) heavily use MongoDB, primarily through its dedicated vector search capability called MongoDB Atlas Vector Search.

While LLMs themselves are trained on massive datasets using specialized file storage and distributed systems, modern AI applications use MongoDB to store operational data, manage conversation history, and perform Retrieval-Augmented Generation (RAG).

Background: The following instructions require the use of the accompanying infographics.

CVE-2026-112368 is an uncontrolled recursion vulnerability found within the BSON decoding engine of the MongoDB PHP driver.

Looking at the workflow on the left, an AI or LLM application continuously reads and writes conversation contexts or high-dimensional vector embeddings ① ②. When fetching data from MongoDB, a continuous binary byte stream is fed back into the driver ③.

Normally, the C-layer decoder scans simple types sequentially, like a string type tag \x02 matching a string value. However, an unauthenticated attacker can craft a malicious binary payload ④. By replacing a standard type tag with an embedded document \x03 or array \x04, they force the C-decoder to stop simple parsing and spawn a recursive loop.

Because the payload value area ⑤ contains thousands of deeply nested document tags packed back-to-back, and the legacy driver completely lacks a nesting depth guard, the engine recursively enters loop after loop ⑥. This rapidly exhausts the native process stack, triggering an uncatchable C-layer crash that brings down the entire PHP runtime ⑦.

To mitigate this loss of availability, the remedy ⑧ is straightforward: apply the official patch via pecl upgrade mongodb to enforce strict recursive depth limits inside the BSON engine.

Vulnerability details: CVE-2026-112368   An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.

Remedy: Apply the Official Patch – Update the extension using PECL or your system’s package manager (e.g., pecl upgrade mongodb). Ensure your environment is running a version where depth guards or recursive controls have been implemented in the BSON decoding logic.

Official announcement: Please refer to the link for details – https://www.tenable.com/cve/CVE-2026-112368