{"id":"CVE-2026-67989","published":"2026-10-02T16:16:51.247","lastModified":"2026-10-02T20:17:03.933","description":"crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-1333"],"vendors":[],"products":[],"references":[{"url":"https://github.com/crmne/ruby_llm","tags":[]},{"url":"https://github.com/crmne/ruby_llm/blob/fa6f279847d6d7027814539d9c0dfc3bbdfd2a83/lib/ruby_llm/providers/mistral/capabilities.rb#L92","tags":[]},{"url":"https://github.com/crmne/ruby_llm/commit/dd3c84812598def03d4aff77b5447c41d8f5c34e","tags":[]}],"exploitRefs":[{"url":"https://github.com/crmne/ruby_llm","tags":[]},{"url":"https://github.com/crmne/ruby_llm/blob/fa6f279847d6d7027814539d9c0dfc3bbdfd2a83/lib/ruby_llm/providers/mistral/capabilities.rb#L92","tags":[]},{"url":"https://github.com/crmne/ruby_llm/commit/dd3c84812598def03d4aff77b5447c41d8f5c34e","tags":[]}],"hasPoc":true,"ai":{"summary":"A polynomial-time regular expression denial-of-service vulnerability exists in the Mistral model capability matching functionality of crmne/ruby_llm, which can be exploited by attackers to cause high CPU consumption and system unresponsiveness when processing malicious input patterns.","exploitability":"Exploitation is relatively straightforward as it requires only sending a specially crafted input pattern that triggers the vulnerable regex engine, with no authentication required and minimal preconditions.","blast_radius":"The impact could affect any system running the affected Ruby 3.1.x version with the Mistral model capability matching feature enabled, potentially causing widespread service unavailability across applications using this library.","remediation":"Upgrade to commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 or later, as this specific commit contains the fix for the regex denial-of-service vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["regex","dos","ruby","llm"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:02:47.717Z"}}