CVE-2026-67991
Received Received - Intake

RubyLLM Regex DoS via Underscore Function

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: MITRE

Description
crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-67991
EUVD
EUVD-2026-58032

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
crmne ruby_llm From 3.1.0 (inc) to 3.1.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a regular expression denial-of-service (ReDoS) issue in the RubyLLM::Utils.underscore function. It occurs when a very long crafted class, agent, or tool name is processed, causing excessive CPU consumption and leading to a denial of service.

Detection Guidance

This vulnerability can be detected by monitoring CPU usage spikes when processing long class, agent, or tool names in Ruby applications using RubyLLM::Utils.underscore. Check for excessive CPU consumption in Ruby processes during string manipulation operations.

Impact Analysis

The vulnerability can impact you by causing your Ruby application to become unresponsive or crash if it processes a specially crafted long input. This may lead to service disruptions, degraded performance, or complete unavailability of the affected system.

Mitigation Strategies

Immediately update RubyLLM to a patched version if available. Avoid using untrusted input in RubyLLM::Utils.underscore. Implement input length validation for class, agent, or tool names. Monitor Ruby processes for abnormal CPU usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67991. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart