CVE-2026-67989

Summary

A polynomial-time regular expression denial-of-service vulnerability exists in the Mistral model capability matching functionality of crmne/ruby_llm, which can be exploited by attackers to cause high CPU consumption and system unresponsiveness when processing malicious input patterns.

Exploitability

Exploitation is relatively straightforward as it requires only sending a specially crafted input pattern that triggers the vulnerable regex engine, with no authentication required and minimal preconditions.

Blast radius

The impact could affect any system running the affected Ruby 3.1.x version with the Mistral model capability matching feature enabled, potentially causing widespread service unavailability across applications using this library.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 or later, as this specific commit contains the fix for the regex denial-of-service vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.