CVE-2026-96745

Katalog CVE

CVSS 5.6 · Medium EPSS 0,30%

Kerentanan Deserialization of Untrusted Data. Skor CVSS 3.1 5.6 (Medium) menurut mongodb.com.

Deskripsi (NVD)

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.

Rincian

Terbit di NVD

24 September 2026

Terakhir diubah

24 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

5.6 (Medium), sumber mongodb.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/mongodb/mongo-php-driver/pull/2115
• https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.10
• https://github.com/mongodb/mongo-php-driver/releases/tag/2.1.10
• https://github.com/mongodb/mongo-php-driver/releases/tag/2.5.3
• https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c