CVE-2026-93761

Summary

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.

Affected Software

VendorProductVersion RangeStatus
MongoDB Inc.Mongoid7.2.0 <= 7.2.6affected
MongoDB Inc.Mongoid7.3.0 <= 7.3.5affected
MongoDB Inc.Mongoid7.4.0 <= 7.4.3affected
MongoDB Inc.Mongoid7.5.0 <= 7.5.4affected
MongoDB Inc.Mongoid7.6.0 <= 7.6.1affected
MongoDB Inc.Mongoid8.0.0 <= 8.0.12affected
MongoDB Inc.Mongoid8.1.0 <= 8.1.12affected
MongoDB Inc.Mongoid9.0.0 <= 9.0.11affected
MongoDB Inc.Mongoid9.1.0affected

Weaknesses

  • CWE-1333: CWE-1333: Inefficient Regular Expression Complexity

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References