{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"php-mongodb","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NQ5WC4DPACW3FNMQSTJMPK","modified_at":"2026-10-23T18:05:32.833518607Z","published_at":"2026-10-19T16:17:07.650Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-112368","https://security-tracker.debian.org/tracker/CVE-2026-112368"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-112368#Debian:14/php-mongodb","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-112368"}],"summary":"An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the pro"}