CVE-2026-82052 — $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars

CVE-2026-82052

$regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars PUBLISHED

Description (CNA)

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.3.0 before 8.3.9; affected 8.0 before 8.0.30; affected 7.0 before 7.0.41

CWE

CWE-617

References

https://jira.mongodb.org/browse/SERVER-127985

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.