Executive brief
Mongoid is a Ruby library that provides object-document mapping for MongoDB databases. An inefficient regular expression vulnerability in the in-memory query evaluation component allows unauthenticated attackers to craft complex regex patterns that cause excessive CPU processing, potentially making applications unresponsive or unavailable. Applications that accept user-supplied pattern-matching queries on embedded associations are particularly vulnerable.
Technical details
The vulnerability stems from inefficient regular expression evaluation in Mongoid's in-memory query matching logic for embedded associations. An unauthenticated attacker can supply a crafted regular expression pattern that causes ReDoS (regular expression denial of service) conditions, consuming excessive CPU resources and causing process unresponsiveness. No authentication is required, but exploitation requires the application to place user input directly into a pattern-matching condition on an embedded association query.
Affected products
- MongoDB Mongoid
Timeline
- 2026-09-18: disclosed