CVE-2026-82052

Undergoing Analysis Undergoing Analysis - In Progress

MongoDB Server Crash via Malformed Regex in Aggregation Pipeline

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: MongoDB, Inc.

Description

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-82052

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user with access to aggregation pipeline stages to crash a MongoDB server by using the $regexFindAll expression. The crash occurs when a regex match starts in the middle of a multi-code-unit character, causing an assertion error during query execution.

Detection Guidance

This vulnerability can be detected by monitoring for crashes in MongoDB servers (mongod) when regex operations are performed in aggregation pipelines. Check server logs for assertion failures or unexpected terminations during regex matching operations.

Impact Analysis

An attacker could exploit this to cause a denial of service by crashing the MongoDB server, leading to downtime and potential data unavailability. This requires authentication and specific conditions, but could disrupt services relying on MongoDB.

Mitigation Strategies

Apply the latest MongoDB security patch immediately. Restrict authenticated user access to aggregation pipeline stages. Disable or monitor regex operations in queries until patched. Review and update firewall rules to limit exposure.

Hi! I’m here to help you understand CVE-2026-82052. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70