Detections
Analytics

Fedora 45 : php-pecl-mongodb2 (2026-ce7737d311)

medium Nessus Plugin ID 374652

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ce7737d311 advisory.

 ## Version 2.5.5

 Release Highlights

 - PHPC-276: Prevent stack exhaustion when decoding deeply nested BSON
 - PHPC-276: Enforce the decode nesting limit for CodeWScope scopes


 ----

 ## Version 2.5.4

 Release Highlights

 - PHPC-2739: Check returns of BSON append operations. **CVE-2026-106436**
 - PHPC-2741: Add additional length BSON length checks. **CVE-2026-106432**
 - PHPC-2505: Fix foreach iteration of MongoDB\Driver\Cursor after garbage collection.


 ----

 ## Version 2.5.3

 * PHPC-2435: Support libmongoc 2.0
 * PHPC-2591, PHPC-2594: Upgrade bundled libmongoc and libmongocrypt dependencies
 * DRIVERS-3105 Add mention of semver
 * Update installation instruction to use `pie`
 * PHPC-2601: Add crypt_shared version to a manager's debug output
 * Minor follow-up work for libmongoc 2 support
 * use ZSTR_IS_INTERNED()
 * Fix dependabot configuration to only update single submodule
 * Fix links to spec documents, migrated from rst to md
 * Upload test results to codecov.io
 * PHPC-2474: Support Binary vector subtype
 * PHPC-2627: Use appropriate return type for zend_object_iterator_funcs.valid
 * PHPC-2638 and PHPC-2630: Bump to libmongoc 2.1.2 and libmongocrypt 1.16.0
 * PHPC-2634: Binary vector corpus tests
 * PHPC-2654: Update to libmongoc 2.2.1
 * PHPC-2649: Update to libmongocrypt 1.17.0
 * PHPC-2664: Drop Windows x86 builds
 * PHPC-2669: Compatibility for PHP 8.6-dev
 * Upgrade bundled dependencies
 * PHPC-2689: Throw LogicException in Binary::getVectorType() and toArray()
 * PHPC-2679: Test PHP 8.5 on Evergreen
 * [PHPC-2647] Out-of-source build: Don't necessarily generate flies in the source tree
 * Add Jrme and Pauline as maintainers
 * PHPC-1971: Use debug builds of PHP for testing
 * Make bson-enum_error resilient to PHP 8.6 interface handler order
 * Stabilize enum interface error handling and tests
 * PHPC-2215: Replace php_phongo prefix
 * Add configuration for Claude Code
 * Harden code after AI-assisted review
 * PHPC-1988: base64 encode binary data when debugging
 * PHPC-2160: Extract calls to bsonSerialize and remove unnecessary check function
 * Use `zend_array_is_list` in `phongo_is_array_or_document`
 * PHPC-2024: Introduce macros for simpler class declarations
 * PHPC-2530: Deprecate hedged reads
 * PHPC-2486: Require non-null namespace and database arguments in Manager
 * Avoid string length calculations for bson_append calls
 * Improve testing notes in CLAUDE.md
 * Add tests to improve coverage of untested or under-tested APIs
 * PHPC-2500: Skip errorLabels assignment for non-RuntimeException exceptions
 * Make bson-enum_error resilient to PHP 8.6 interface handler order
 * Add macros to simplify handling of internal structs
 * Use DBX PR app to create merge-up pull requests
 * PHPC-2699: Add typed, read-only properties for value objects and events
 * PHPC-2700: Fix cloning Javascript objects without a scope
 * Use `json_decode` to produce a non-interned string in typeMap test
 * Generate legacy arginfo for older PHP versions
 * Remove `phongo_write_concern_to_zval`
 * PHPC-2699: Rename durationMicros properties
 * PHPC-1519: Remove phongo_server_to_zval and include Server objects in Manager debug output
 * Remove tests that only ran on PHP 7 and clean up version-specific SKIPIFs
 * PHPC-2699: Add readonly properties to WriteConcernError class
 * Remove extra structs for objects with properties
 * PHPC-1514 Remove `php_phongo_read_concern_to_zval`
 * PHPC-2702 PHPC-2698 Upgrade libmongoc to 2.3.0 and libmongocrypt to 1.17.3
 * PHPC-2695 Replace deprecated bson_append_array_begin with bson_append_array_unsafe_begin
 * Relax check on internal object id, not relevant for the test
 * Remove unnecessary structs for BSON MinKey and MaxKey classes
 * PHPC-2660 Test that killCursors is sent after a connection error during getMore
 * PHPC-1627 Support object cloning for ReadConcern, ReadPreference, and WriteConcern
 * Update release instructions
 * PHPC-2714: Fix in-tree PHP builds
 * Fix ZVAL_STATIC_INIT macro formatting for clang-format compatibility
 * Replace XtOffsetOf() with offsetof() for PHP 8.6
 * Backport: Replace XtOffsetOf with offsetof for PHP 8.6 compatibility
 * PHPC-2715: Fix out-of-source-tree builds
 * PHPC-2647, PHPC-2715: Fix all possible build configurations (standalone vs. in-tree, in-source vs. out- of-source)
 * Use debug env var for debug builds
 * Implement memory handling correctness fixes
 * PHPC-2721: Exclude generated config headers from PECL package
 * PHPC-2721: Test PECL package installation on Alpine Linux
 * PHPC-2708: Automatically create new minor version branch on release
 * PHPC-2724: Bump libmongocrypt to 1.19.0
 * PHPC-2729: Bump libmongocrypt to 1.20.0
 * PHPC-2731: Pin libmongocrypt runtime and dev packages in lockstep
 * DEVPROD-34208: use Silkbomb image from ECR instead of Artifactory
 * PHPC-2738: Escape release notes when generating package.xml
 * PHPC-2728: Add `stringOpts` support and bump libmongoc 2.4.0
 * PHPC-2708: Update release docs and add version-transition reminders
 * Update maintainers: add Kevin Albertson, mark Andreas Braun inactive
 * PHPC-2753 Add link to ECR log-in
 * PHPC-2742: Bump libmongocrypt to 1.20.2
 * PHPC-2755: Fix test suite failures with PHP 8.6
 * PHPC-2751: Upgrade libmongoc to 2.5.0
 * PHPC-2745: Reject null bytes in namespaces and periods in database names [v2.4]
 * PHPC-2754: Update libmongocrypt to 1.20.3
 * PHPC-2756: Upgrade libmongoc to 2.5.1
 * PHPC-2763 PHPC-2757 Upgrade libmongoc to 2.5.2 and libmongocrypt to 1.20.4
 * PHPC-2744 Fix dependency issue
 * PHPC-2771: Upgrade libmongoc to 2.5.4
 * PHPC-2773: Upgrade libmongoc to 2.5.5
 * PHPC-2743: Fix `__pclass` inference in events


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected php-pecl-mongodb2 package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2026-ce7737d311

Plugin Details

Severity: Medium

ID: 374652

File Name: fedora_2026-ce7737d311.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/31/2026

Updated: 10/31/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.43

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C

CVSS Score Source: CVE-2026-106432

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 1.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-106436

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:45, p-cpe:/a:fedoraproject:fedora:php-pecl-mongodb2

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/15/2026

Vulnerability Publication Date: 10/8/2026

Reference Information

CVE: CVE-2026-106432, CVE-2026-106436