{"id":"CVE-2026-93761","title":"An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process","summary":"An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-1333"],"vendor":"mongodb","product":"mongoid","affected":["mongoid >= 8.0.0, < 8.0.13","mongoid >= 8.1.0, < 8.1.13","mongoid >= 9.0.0, < 9.0.12","mongoid = 9.1.0"],"patched":["mongoid 9.0.12"],"published":"2026-09-18","updated":"2026-09-24","sourceUpdated":"2026-09-24T16:06:04.550","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93761","references":[{"url":"https://jira.mongodb.org/browse/MONGOID-5981","label":"cna@mongodb.com"}],"tags":["nvd","cve.org"],"epss":0.0046,"epssPercentile":0.37138,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-19T13:43:12.765955Z"},"ingestedAt":"2026-09-18T17:46:41.548Z","slug":"CVE-2026-93761","body":"## Overview\n\nAn inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.\n\n## Affected\n\n- `mongoid >= 8.0.0, < 8.0.13`\n- `mongoid >= 8.1.0, < 8.1.13`\n- `mongoid >= 9.0.0, < 9.0.12`\n- `mongoid = 9.1.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `mongoid 9.0.12`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}