# CVE-2026-93761: Mongoid inefficient regex complexity in query evaluation

Source: https://junglewise.ai/threats/cve-2026-93761-an-inefficient-regular-expression-complexity-issue-in-the-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93761 · Severity: high · CVSS 7.5 · Published 2026-09-18

Mongoid is a Ruby library that provides object-document mapping for MongoDB databases. An inefficient regular expression vulnerability in the in-memory query evaluation component allows unauthenticated attackers to craft complex regex patterns that cause excessive CPU processing, potentially making applications unresponsive or unavailable. Applications that accept user-supplied pattern-matching queries on embedded associations are particularly vulnerable.

Technologies: [MongoDB Mongoid](https://junglewise.ai/threats/technologies/mongoid). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-93761 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93761 being exploited in the wild.

**How severe is CVE-2026-93761?** High severity, with a CVSS score of 7.5, published 18 September 2026.

**Which products and versions are affected?** MongoDB Mongoid.

**Is there a fix for CVE-2026-93761?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93761 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93761?** Check whether you run MongoDB Mongoid. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from inefficient regular expression evaluation in Mongoid's in-memory query matching logic for embedded associations. An unauthenticated attacker can supply a crafted regular expression pattern that causes ReDoS (regular expression denial of service) conditions, consuming excessive CPU resources and causing process unresponsiveness. No authentication is required, but exploitation requires the application to place user input directly into a pattern-matching condition on an embedded association query.

## Affected products

- MongoDB Mongoid

## Timeline

- 2026-09-18: disclosed

## References

- [https://jira.mongodb.org/browse/MONGOID-5981](https://jira.mongodb.org/browse/MONGOID-5981)

## Related threats

- [Mongoid client-side encryption omission in embedded models](https://junglewise.ai/threats/cve-2026-93764-mongoid-may-omit-encryption-rules-for-fields-declared-on-embedded)
- [Mongoid unsafe reflection weakness in query path for embedded documents](https://junglewise.ai/threats/cve-2026-93762-mongoid-contains-an-unsafe-reflection-weakness-in-the-query-path)
- [Mongoid query operator injection via unsanitized filter parameters](https://junglewise.ai/threats/cve-2026-93760-mongoid-does-not-restrict-which-query-operators-may-come-from)
- [Mongoid query builder NoSQL injection via string criteria](https://junglewise.ai/threats/cve-2026-93759-mongoid-does-not-neutralize-a-string-typed-query-criterion)
- [Mongoid unsafe reflection in document persistence layer](https://junglewise.ai/threats/cve-2026-93765-mongoid-contains-an-unsafe-reflection-weakness-in-the-document)