Executive brief
MongoDB is a widely-used database system that supports complex data queries through aggregation pipelines. An authenticated user with permission to run aggregation queries can crash the database server by using the $regexFindAll expression in a specific way that causes the regex engine to process invalid UTF-8 character boundaries, resulting in service downtime and potential data access disruptions.
Technical details
The vulnerability is a denial of service (DoS) in MongoDB's $regexFindAll aggregation pipeline expression. An authenticated user who can execute aggregation pipeline stages can trigger an assertion failure in the query execution engine by crafting a regex match that starts in the middle of a multi-code-unit UTF-8 character, rather than on a proper character boundary. This assertion causes the mongod server process to crash. The fix, available in versions 7.0.41, 8.0.30, 8.3.9, 9.0.0-rc2, 9.1.0-rc0 and later, rejects regex matches that do not align with UTF-8 character boundaries. Authentication is required as a prerequisite to execute aggregation pipelines, limiting exposure to authorized users.
Affected products
- MongoDB MongoDB Server before 7.0.41, 8.0.30, 8.3.9, 9.0.0-rc2, 9.1.0-rc0
Timeline
- 2026-09-08: disclosed: CVE-2026-82052 published
- 2026-09-08: patched: Fixed in 7.0.41, 8.0.30, 8.3.9, 9.0.0-rc2, 9.1.0-rc0 and later