CVE-2026-67987

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67987
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67987.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67987
Downstream
Published
2026-09-29T00:00:00Z
Modified
2026-10-28T02:30:36Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in two consecutive regular expressions and delay chat-completion processing

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67987.json"
}
References

Affected packages

Git / github.com/crmne/ruby_llm

Affected ranges

Type
GIT
Repo
https://github.com/crmne/ruby_llm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5e88411f171721b381853fa77d254e266dcf6ad8
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "fa6f279847d6d7027814539d9c0dfc3bbdfd2a83"
                }
            ],
            "source":  "DESCRIPTION"
        },
        {
            "range":  [
                {
                    "fixed":  "5e88411f171721b381853fa77d254e266dcf6ad8"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.1.0.pre42
1.*
1.0.0
1.0.1
1.1.0
1.1.0rc1
1.1.0rc2
1.1.1
1.1.2
1.10.0
1.11.0
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.14.0
1.14.1
1.15.0
1.16.0
1.2.0
1.3.0
1.3.0rc1
1.3.1
1.4.0
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.7.0
1.7.1
1.8.0
1.8.1
1.8.2
1.9.0
1.9.1
1.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67987.json"