CVE-2026-93761
Description
A flaw was found in Mongoid. An inefficient regular expression (regex) complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated attacker to cause excessive processing within an embedding application. This can lead to a denial of service (DoS) where applications become unresponsive when user-supplied text is placed into a pattern-matching query condition on an embedded association.
Statement
This vulnerability is rated as having Important impact because remote, unauthenticated attackers can cause complete service unavailability through CPU exhaustion without requiring elevated privileges. A denial of service occurs when Ruby applications utilizing Mongoid feed untrusted strings into regex-based criteria evaluated in memory against embedded documents. Because this issue affects a client-side data-mapping library rather than standard platform services, exposure is limited to custom applications that accept unvalidated user queries and deploy this component.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
