Hi,

The following vulnerabilities were published for php-mongodb.

CVE-2026-106432[0]:
| The BSON encoder in the MongoDB PHP Driver converts a string length
| to a 32-bit value without validation. When an affected application
| encodes a string near 4 GiB, the allocation size can wrap while the
| copy operation uses the original length. The resulting heap buffer
| overflow can corrupt process memory or terminate the PHP process.
| Reaching this issue requires a non-default runtime configuration
| that permits multi-gigabyte values. No MongoDB server interaction is
| required.


CVE-2026-106436[1]:
| The BSON encoder in the MongoDB PHP Driver does not check some
| return values after a document exceeds libbson's size limit. This
| can leave the encoder in an invalid state. An unauthenticated actor
| who can cause an affected application to encode an unusually large
| data structure can terminate the PHP worker or cause the resulting
| document to omit fields. No MongoDB server connection or database
| authentication is required.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-106432
https://www.cve.org/CVERecord?id=CVE-2026-106432
https://jira.mongodb.org/browse/PHPC-2741
[1] https://security-tracker.debian.org/tracker/CVE-2026-106436
https://www.cve.org/CVERecord?id=CVE-2026-106436
https://jira.mongodb.org/browse/PHPC-2739

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore