CVE-2026-93761: Denial of service via unbounded regex matching in Mongoid's in-memory query matcher
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Mongoid’s in-memory query evaluation for embedded associations are exposed when they place user-supplied text into a pattern-matching query condition.
Does exploitation require an authenticated account or user interaction?
No. The supplied severity vector indicates that exploitation is network-accessible, requires low attack complexity, and needs neither privileges nor user interaction.
What is the practical impact of exploitation?
An attacker may cause excessive processing in the embedding application process, potentially making the application unresponsive. The provided impact vector identifies availability impact only, with no indicated confidentiality or integrity impact.