MEDIUM6.8
GHSA-mwcc-7vpp-xmv9
MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory
Quick fix
GHSA-mwcc-7vpp-xmv9 — mongodb/mongodb-extension: upgrade to the fixed version with the command below.
composer require mongodb/mongodb-extension:^1.21.2Details
A mongoc_bulk_operation_t may read invalid memory if large options are passed.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/mongodb/mongodb-extension
Introduced in:
0Fixed in: 1.21.2Fix
composer require mongodb/mongodb-extension:^1.21.2References
- https://nvd.nist.gov/vuln/detail/CVE-2025-12119[ADVISORY]
- https://github.com/mongodb/mongo-c-driver/commit/775998df7c67[WEB]
- https://github.com/mongodb/mongo-php-driver/commit/fa5b43366407bc0e5b0a919ed374decd9022b2f9[WEB]
- https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6[WEB]
- https://github.com/mongodb/mongo-c-driver/releases/tag/2.1.2[WEB]
- https://github.com/mongodb/mongo-php-driver[PACKAGE]
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.2[WEB]
- https://jira.mongodb.org/browse/PHPC-2637[WEB]
- https://lists.debian.org/debian-lts-announce/2026/01/msg00009.html[WEB]