Vulnerability · Published Sep 18, 2026 · Assigned by mongodb
CVE-2026-93761Denial of service via unbounded regex matching in Mongoid's in-memory query matcher
High 7.5
In plain English
A high-severity regular-expression denial of service in Mongoid from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc. | Mongoid | 7.2.0 – through 7.2.67.3.0 – through 7.3.57.4.0 – through 7.4.37.5.0 – through 7.5.47.6.0 – through 7.6.18.0.0 – through 8.0.128.1.0 – through 8.1.129.0.0 – through 9.0.11 |
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H