{"action":"Upgrade php-mongodb to 2.0.0-1+deb13u2 or later.","affected":[{"fixed":"2.0.0-1+deb13u2","introduced":"0"}],"component":"php-mongodb","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["2.0.0-1+deb13u2"],"id":"tcs_01M5NQ5W8XJX92XEJWQRNEGN94","modified_at":"2026-10-31T10:00:34.794014529Z","published_at":"2026-10-19T16:17:07.650Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-112368","https://security-tracker.debian.org/tracker/CVE-2026-112368"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-112368#Debian:13/php-mongodb","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-112368"}],"summary":"An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the pro"}