High severity · published Sep 18, 2026
CVE-2026-93761
Denial of service via unbounded regex matching in Mongoid's in-memory query matcher
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mongoid · MongoDB Inc.
7.2.0 through 7.2.6; 7.3.0 through 7.3.5; 7.4.0 through 7.4.3; 7.5.0 through 7.5.4; 7.6.0 through 7.6.1; 8.0.0 through 8.0.12; +3 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93761
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93761
Permissions Required
https://jira.mongodb.org/browse/MONGOID-5981
More from Mongoid
9.8
CVE-2026-93762
Data deletion and attribute disclosure via field-name method injection in in-memory queries
9.1
CVE-2026-93765
Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation
8.6
CVE-2026-93759
Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist
8.2
CVE-2026-93760
NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
8.1
CVE-2026-93758
Cross-principal document update, theft, and deletion via unvalidated id in nested attributes