CVE-2026-82052 in MongoDB
Summary
by MITRE • 09/08/2026
The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
An authentication bypass and denial-of-service vulnerability exists within the MongoDB database management system, specifically affecting versions prior to 5.0.14, 6.0.3, and 7.0-rc2. This flaw is located in the implementation of the $regexFindAll aggregation pipeline expression, which allows authenticated users with access to run aggregation stages to trigger a server crash. The vulnerability arises from improper handling of regular expressions when processing multi-byte character sequences. Specifically, under certain conditions involving specific Unicode characters and regex patterns, the matching engine may initiate a search operation in the middle of a multi-code-unit character rather than at valid code point boundaries. This misalignment causes an internal assertion failure during query execution, leading to an immediate termination of the mongod process and resulting in a denial-of-service condition for all connected clients.
The technical root cause lies in the regex engine's inability to correctly validate boundary conditions when scanning through UTF-8 encoded strings that contain multi-byte characters. When the search pointer advances past the start of such a character, it encounters invalid byte sequences or misaligned state transitions within the regular expression matcher. Instead of gracefully handling this edge case by skipping to the next valid code point or returning no match, the software triggers an assertion error. Assertions are typically used during development and testing phases to catch programming errors but should not be triggered in production environments under normal operational conditions. The presence of these assertions indicates a lack of robust input validation and boundary checking within the regex processing logic for aggregation pipelines.
From a threat modeling perspective, this vulnerability is classified as CWE-20: Improper Input Validation combined with CWE-754: Improper Check for Unusual or Exceptional Conditions. It allows an authenticated attacker to cause a denial of service without requiring elevated privileges beyond standard database access rights. In the context of the MITRE ATT&CK framework, this behavior aligns with T1499: Endpoint Denial of Service and potentially T1053: Scheduled Task/Job if exploited in conjunction with automated scripts targeting critical infrastructure services. The impact is significant for environments where high availability is required, as a single malicious query can take down the entire database instance, disrupting business operations that rely on real-time data access.
Mitigation strategies primarily involve upgrading to patched versions of MongoDB such as 5.0.14, 6.0.3, or later releases in the 7.0 series where this assertion has been removed and proper boundary checks implemented. For organizations unable to patch immediately due to compatibility constraints, operational mitigations include restricting access to aggregation pipelines to only those users who absolutely require such permissions. Additionally, implementing network-level controls to limit the rate of complex query submissions can reduce the likelihood of exploitation attempts. Security teams should also monitor system logs for assertion errors or unexpected mongod process restarts as indicators of potential exploitation activity in their environments.