BaseFortify

Executive Summary

This vulnerability is a regular expression denial-of-service (ReDoS) issue in the ruby_llm gem's Mistral provider. It occurs when processing long model IDs containing repeated 'voxtral' strings without matching suffixes. The original regex patterns like /voxtral.*tts/ and /voxtral.*transcribe/ caused quadratic time complexity, making the system slow or unresponsive when handling such inputs.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the ruby_llm gem's Mistral provider and involves inefficient regex pattern matching in Ruby 3.1.x. To detect it, check if your application uses the ruby_llm gem version affected by CVE-2026-67989 and inspect model ID handling for Voxtral variants. Look for regex patterns like /voxtral.*tts/ or /voxtral.*transcribe/ in your codebase.

Useful 0 Not Useful 0

Impact Analysis

If you use the ruby_llm gem with Ruby 3.1.x and interact with Mistral AI models, an attacker could send a specially crafted model ID to trigger the ReDoS. This could cause your application to slow down significantly or become unresponsive, potentially leading to denial-of-service conditions in your system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a denial-of-service condition caused by inefficient regex pattern matching in Ruby 3.1.x, which could degrade system performance under specific conditions. It does not directly involve data exposure or unauthorized access, so its impact on compliance with GDPR or HIPAA is likely minimal unless the DoS condition disrupts services handling regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Update the ruby_llm gem to the latest version that includes the fix for CVE-2026-67989. Replace regex-based model ID checks with the new String#index-based methods (voxtral_followed_by? and voxtral_modalities_for) as shown in the patched capabilities.rb file.

Useful 0 Not Useful 0