CVE-2026-82052

MediumCVSS 6.5/10Last modified Sep 16, 2026

Description

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Vendor	Product	Versions
MongoDB	MongoDB Server	>= 8.3.0, < 8.3.9; >= 8.0, < 8.0.30; >= 7.0, < 7.0.41

References

https://jira.mongodb.org/browse/SERVER-127985Issue Tracking, Vendor Advisory

Timeline

Published: Sep 8, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-820538.1A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities CVE-2026-820546.5A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command include CVE-2026-820556.5A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a s CVE-2026-820565.3A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under c CVE-2026-820576.5A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By s CVE-2026-820586.5A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod CVE-2026-820596.5An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being re CVE-2026-82069.8The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeo CVE-2026-820605.4In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specia CVE-2026-820618.1A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges CVE-2026-820625.5A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the a CVE-2026-820635.3A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of servi