このページは Ubuntu 向けの修正状況です。脆弱性そのものの説明は CVE 本体のページにあります。
CVE-2026-106432 の詳細 →
UBUNTU-CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a strin...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.
出典: OSV.dev (Open Source Vulnerabilities) OSV
影響パッケージ
Ubuntu:16.04:LTS
php-mongodb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
php-mongodb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
php-mongodb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
php-mongodb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
php-mongodb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
php-mongodb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
php-mongodb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
参照URL
- report ubuntu.com
- report cve.org
- report jira.mongodb.org