CVE-2026-93761
Last modified
CVE-2026-93761 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.. EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mongodb | Mongoid | >= 8.0.0, < 8.0.13 |
| Mongodb | Mongoid | >= 8.1.0, < 8.1.13 |
| Mongodb | Mongoid | >= 9.0.0, < 9.0.12 |
| Mongodb | Mongoid | 9.1.0 |
References
- https://jira.mongodb.org/browse/MONGOID-5981Permissions Required
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-93761?
How severe is CVE-2026-93761?
How do I fix CVE-2026-93761?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-93756The Smash Balloon Social Post Feed – Simple Social Feeds for…7.2
- CVE-2026-93757The Wild Apricot Login plugin for WordPress is vulnerable to…7.5
- CVE-2026-93758An insecure direct object reference in the nested attributes…8.1
- CVE-2026-93759Mongoid does not neutralize a string-typed query criterion s…8.6
- CVE-2026-9376A vulnerability was determined in JPress up to 1.0.3. The af…6.3
- CVE-2026-93760Mongoid does not restrict which query operators may come fro…8.2
- CVE-2026-93762Mongoid contains an unsafe reflection weakness in the query …9.8
- CVE-2026-93763A protection mechanism failure in the object-document mapper…6.5
- CVE-2026-93764Mongoid may omit encryption rules for fields declared on emb…6.5
- CVE-2026-93765Mongoid contains an unsafe reflection weakness in the docume…9.1
- CVE-2026-93767The Tainacan plugin for WordPress is vulnerable to Directory…6.5
- CVE-2026-93769HumHub 1.18.5 is affected by a stored cross-site scripting (…7.2
Are you affected by CVE-2026-93761?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST