rootpwn

high · CVSS v3 7.5 · CVSS v4 8.7 · EPSS 0.00268

CVE-2026-93761

An inefficient regular expression complexity vulnerability exists in the in-memory query evaluation component of the Mongoid library. Unauth

Overview

An inefficient regular expression complexity vulnerability exists in the in-memory query evaluation component of the Mongoid library. Unauthenticated parties can trigger excessive processing by supplying specific text into pattern-matching query conditions on embedded associations. This causes the embedding application process to become unresponsive.

Description

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.

Impact

The primary impact is a denial of service (Availability) affecting applications utilizing vulnerable versions of the Mongoid library. Integrity and Confidentiality are not directly impacted by this flaw. System administrators and services hosting applications that accept unvalidated user input for embedded association queries are at risk of unexpected application downtime.

Remediation

Update the Mongoid library to the latest patched version provided by the vendor. Review application logic to ensure user-supplied data used in pattern-matching query conditions is strictly validated, sanitized, or rate-limited. Implement application-level monitoring and timeout mechanisms to detect and mitigate potential resource exhaustion events.

Risk context

This vulnerability carries a high severity rating with a CVSS v3 score of 7.5 and a CVSS v4 score of 8.7, indicating significant potential impact to application availability. The current EPSS score is 0.00268, suggesting low observed exploitation activity in the wild at this time, but defenders should prioritize patching due to the ease of triggering via unauthenticated user input.

Affected products

  • MongoDB Mongoid

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
8.7
EPSS
0.00268

Mongoid MongoDB ReDoS Denial of Service Ruby Input Validation High Severity

← All CVEs

Related CVEs

high

CVE-2026-94001

A permission validation flaw exists in the Admin REST API of Keycloak related to user credential deletion. Specifically, the endpoint fails to properly enforce fine-grained reset-password permissions for delegated administrators. This matters because restricted administrators can exploit this gap to delete user passwords, leading to a denial of service for affected users.

View analysis

high

CVE-2026-82560

CVE-2026-82560 causes CPU and memory exhaustion in Perl's Pod::Text when processing deeply nested =over directives. The vulnerability leads to denial of service by exhausting system resources. It affects all installations using Pod::Text prior to version 6.1.1.

View analysis

high

CVE-2026-84750

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 lacks proper file type and extension validation during unauthenticated uploads. Files are stored at predictable public paths, which can lead to remote code execution on specific server stacks or stored cross-site scripting on others.

View analysis

high

CVE-2026-85574

The Unbounce Landing Pages WordPress plugin prior to version 1.1.5 lacks proper authorization checks when updating its front-end proxy configuration. This flaw enables low-privileged authenticated users, such as subscribers, to redirect the proxy to arbitrary external hosts and serve unauthorized content under the trusted site origin.

View analysis