CVE-2026-82052

CVE-2026-82052 is a denial-of-service flaw in MongoDB Server (mongod) in which the $regexFindAll aggregation expression can hit a reachable assertion (CWE-617) and crash the server process. It is triggered when an authenticated user who is allowed to run aggregation pipelines submits a query in which, under specific conditions, the regex match begins in the middle of a multi-code-unit (multi-byte) character. An attacker gains only availability impact — a mongod crash — per the CVSS metrics (high availability impact, no confidentiality or integrity impact), though the crash disrupts all clients of the affected instance. Any MongoDB deployment in which untrusted or low-privileged authenticated users can execute aggregations is affected; the available data does not specify affected or fixed version ranges. Exploitation is not currently known: there is no public PoC, the flaw is not in CISA KEV, and EPSS estimates only a 0.4% chance of exploitation within 30 days (29th percentile).

What to do: Upgrade MongoDB Server to a patched release as specified in MongoDB's official advisory for CVE-2026-82052 (fixed versions are not listed in the available data). Until patched, restrict aggregation pipeline privileges to trusted users and limit untrusted authenticated clients, and monitor mongod logs for assertion failures or unexpected restarts that could indicate attempted exploitation.