This vulnerability arises from inefficient handling of regular expressions within Mongoid's in-memory query evaluation. Specifically, when user input is embedded in pattern-matching query conditions on associations, the complexity of the regular expression can cause excessive CPU consumption. This can lead to denial of service by making the application process unresponsive. The vulnerability affects multiple versions of Mongoid from 7.2.0 through 9.1.0 as explicitly listed. There is no indication of known exploits in the wild or cloud service impact.

An unauthenticated attacker can exploit this vulnerability to cause excessive processing load on the affected application, potentially leading to denial of service by making the application unresponsive. This impacts availability but does not indicate confidentiality or integrity compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor MongoDB Inc. advisories for updates and apply patches once available. Until then, avoid placing untrusted user input directly into pattern-matching query conditions on embedded associations.