CVE-2026-93761CWE-1333

CVE-2026-93761

High · published September 18, 2026

CVSS v3.1

7.5

EPSS

Percentile

38.9

In the wild

Unconfirmed

What it is

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00460 · 38.9th percentile
Weakness: CWE-1333 · Inefficient Regular Expression Complexity
Published: 2026-09-18T22:18Z

Affected products (4)

Product	Versions	Fixed in
mongodb/mongoid	≥ 8.0.0, < 8.0.13	8.0.13
mongodb/mongoid	≥ 8.1.0, < 8.1.13	8.1.13
mongodb/mongoid	≥ 9.0.0, < 9.0.12	9.0.12
mongodb/mongoid	all versions	—

References (1)

https://jira.mongodb.org/browse/MONGOID-5981 · [email protected]

EPSS history

Timeline

20 SEP 03:25Z
EPSS moved — → 0%
epss
18 SEP 17:20Z
Denial of service via unbounded regex matching in Mongoid's in-memory query matcher
cvelistv5