CVE-2026-93761: MongoDB Mongoid DOS Vulnerability

CVE-2026-93761 Overview

CVE-2026-93761 is a Regular Expression Denial of Service (ReDoS) vulnerability in the MongoDB Mongoid library. The flaw resides in the in-memory query evaluation component, where inefficient regular expression complexity [CWE-1333] allows an unauthenticated attacker to trigger excessive processing. Applications that pass user-supplied text into a pattern-matching query condition on an embedded association become unresponsive under crafted input. Mongoid version 9.1.0 is confirmed affected.

Critical Impact
Remote unauthenticated attackers can send crafted input to pattern-matching queries on embedded associations, causing sustained CPU exhaustion and rendering Ruby application processes unresponsive.

Affected Products

MongoDB Mongoid 9.1.0
Ruby applications embedding the Mongoid Object-Document Mapper (ODM)
Applications that route unsanitized user input into Mongoid query conditions targeting embedded associations

Discovery Timeline

2026-09-18 - CVE-2026-93761 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-93761

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw classified as [CWE-1333]: Inefficient Regular Expression Complexity. Mongoid provides in-memory query evaluation for embedded associations, allowing developers to filter documents already loaded in memory rather than delegating to the MongoDB server. This evaluation layer applies regular expressions to string fields when pattern-matching operators are used. When an attacker controls the input value passed into that pattern-matching condition, catastrophic backtracking can occur.

The impact is limited to availability. Confidentiality and integrity are unaffected. A single request can consume a worker thread for an extended period, and a small number of concurrent requests can exhaust available worker capacity in Puma, Unicorn, or similar Ruby application servers.

Root Cause

The root cause is the absence of complexity bounds on regular expressions constructed or evaluated during in-memory matching against embedded association fields. Ruby's default regular expression engine (Onigmo) is susceptible to catastrophic backtracking on patterns that contain nested quantifiers or ambiguous alternation. When user-controlled text reaches this evaluation path, it can produce a pattern or input pair whose match time scales exponentially with input length.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker submits a crafted string through any HTTP endpoint, API, or upstream data source that feeds a Mongoid pattern-matching query on an embedded association. The malicious input triggers exponential backtracking during in-memory evaluation, blocking the request thread. Refer to the MongoDB Jira Issue MONGOID-5981 for technical specifics of the affected query path.

No verified proof-of-concept code has been published. The vulnerability manifests when user-supplied text is placed into a pattern-matching query condition on an embedded association, so any request path exposing such a query is exploitable.

Detection Methods for CVE-2026-93761

Indicators of Compromise

Ruby worker processes sustaining 100% CPU utilization on a single core while handling a single request
Request latency spikes concentrated on endpoints that filter embedded association fields
Application server timeouts (Puma, Unicorn) coinciding with inbound requests containing long or repetitive string parameters
Rack or Rails request logs showing extended processing times against Mongoid-backed controllers

Detection Strategies

Inventory Ruby applications using Mongoid and identify controllers that pass request parameters into where, any_of, or regex-based query conditions on embedded documents
Enable APM instrumentation on Mongoid query methods to surface abnormally long in-memory evaluation times
Deploy Web Application Firewall (WAF) rules that flag request parameters containing repetitive character classes or nested quantifier patterns

Monitoring Recommendations

Alert on sustained per-process CPU usage exceeding a defined threshold for Ruby application workers
Track request duration percentiles per endpoint and alert on P99 regressions against endpoints that query embedded associations
Correlate application server thread saturation events with inbound request payloads to identify probing behavior

How to Mitigate CVE-2026-93761

Immediate Actions Required

Identify all applications running Mongoid 9.1.0 and enumerate query paths that accept user input for pattern matching on embedded associations
Apply strict server-side input validation, restricting parameter length and rejecting characters used to construct regex metacharacters
Add request timeouts at the application server layer to bound the impact of any single long-running request
Monitor the MongoDB Jira Issue MONGOID-5981 tracker for the official fixed release and upgrade when available

Patch Information

At the time of publication, no fixed version is listed in the enriched CVE data. Consult the MongoDB Jira Issue MONGOID-5981 for remediation status and upgrade guidance from the Mongoid maintainers.

Workarounds

Escape user input with Regexp.escape before constructing any regex-based Mongoid query condition to neutralize user-controlled metacharacters
Delegate pattern matching to the MongoDB server instead of Mongoid's in-memory evaluation where feasible, since server-side matching does not use the vulnerable code path
Enforce input length limits (for example, 128 characters) on all fields feeding pattern-matching queries
Wrap suspect query calls with a Ruby Timeout block to fail fast when evaluation exceeds a bounded duration

bash

# Configuration example: enforce Puma worker timeout to bound ReDoS impact
# config/puma.rb
worker_timeout 15
worker_shutdown_timeout 5

# Rack middleware: reject oversized query parameters before they reach Mongoid
# config/application.rb
config.middleware.use Rack::Attack
# config/initializers/rack_attack.rb
Rack::Attack.blocklist('oversized-search-param') do |req|
  req.params['q'].is_a?(String) && req.params['q'].length > 128
end