← Back to CVE List
CVE-2026-93761NVD
Vulnerability Summary
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.
CVSS v4.0 Base Metrics — Score 8.7 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)None
Integrity (Vulnerable System)None
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 7.5 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Affected & Patched Versions
- MongoDB Inc. Mongoid >= 7.2.0 and <= 7.2.6
- MongoDB Inc. Mongoid >= 7.3.0 and <= 7.3.5
- MongoDB Inc. Mongoid >= 7.4.0 and <= 7.4.3
- MongoDB Inc. Mongoid >= 7.5.0 and <= 7.5.4
- MongoDB Inc. Mongoid >= 7.6.0 and <= 7.6.1
- MongoDB Inc. Mongoid >= 8.0.0 and <= 8.0.12
- MongoDB Inc. Mongoid >= 8.1.0 and <= 8.1.12
- MongoDB Inc. Mongoid >= 9.0.0 and <= 9.0.11
- MongoDB Inc. Mongoid >= 9.1.0
- MongoDB Inc. Mongoid 7.2.6
- MongoDB Inc. Mongoid 7.3.5
- MongoDB Inc. Mongoid 7.4.3
- MongoDB Inc. Mongoid 7.5.4
- MongoDB Inc. Mongoid 7.6.1
- MongoDB Inc. Mongoid 8.0.12
- MongoDB Inc. Mongoid 8.1.12
- MongoDB Inc. Mongoid 9.0.11