CVE-2026-67987

Deferred Deferred - Pending Action

Regular Expression DoS in ruby_llm via Think-Tag Parsing

Publication date: 2026-09-29

Last updated on: 2026-10-01

Assigner: MITRE

Description

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated <think> tags can cause excessive CPU consumption in two consecutive regular expressions and delay chat-completion processing

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-67987

EUVD

EUVD-2026-89427

Affected Vendors & Products

Vendor	Product	Version / Range
crmne	ruby_llm	From 3.1.0 (inc) to 3.1.9 (inc)
crmne	ruby_llm	From 3.1.0 (inc) to 3.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

Executive Summary

This vulnerability is a polynomial-time regular expression denial-of-service (ReDoS) issue in the RubyLLM library. It occurs when parsing unterminated <think> tags in model responses using two regular expressions that consume excessive CPU time. The scanner was originally added for Perplexity's sonar-reasoning feature but has since been retired.

Detection Guidance

Detecting this vulnerability requires checking for excessive CPU usage during chat completion processing, particularly when parsing responses with unterminated <think> tags. Monitor system performance during AI model interactions and inspect logs for delayed responses or high CPU load.

Impact Analysis

An attacker could send malicious responses with many unterminated <think> tags, causing high CPU usage and delaying chat-completion processing. This could lead to service degradation or denial of service for applications using the RubyLLM library.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a denial-of-service issue causing excessive CPU consumption due to malformed input handling in a Ruby library. No data exposure or privacy violation is described in the provided context.

Mitigation Strategies

Update the ruby_llm library to the latest version where the <think> tag scanner has been removed. If using an older version, remove the tag-parsing logic from both the non-streaming scanner and streaming accumulator as described in the fix.

Hi! I’m here to help you understand CVE-2026-67987. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70