Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-82052

$regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the  regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 8.3.0 to < 8.3.9affected
  • 8.0 to < 8.0.30affected
  • 7.0 to < 7.0.41affected

References