CVE-2026-67991 crmne CVE debrief

Who should care

Users of crmne/ruby_llm, especially those using Ruby 3.1.x, should be aware of this vulnerability and take necessary precautions to mitigate potential attacks. This includes reviewing and applying vendor patches or updates, implementing compensating controls, monitoring systems, and performing inventory checks to identify potentially affected systems. Security teams and operators should prioritize this vulnerability due to its HIGH CVSS severity score of 7.5 and potential for denial-of-service conditions.

Technical summary

The crmne/ruby_llm repository at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service. This condition can be mitigated by reviewing and applying vendor patches or updates for crmne/ruby_llm, implementing compensating controls such as input validation and rate limiting, and monitoring systems for excessive CPU consumption and denial-of-service conditions.

Defensive priority

High-priority defensive actions are recommended due to the HIGH CVSS severity score of 7.5 for this vulnerability.

Recommended defensive actions

• Review and apply vendor patches or updates for crmne/ruby_llm.
• Implement compensating controls, such as input validation and rate limiting, to mitigate potential attacks.
• Monitor systems for excessive CPU consumption and denial-of-service conditions.
• Perform inventory checks to identify potentially affected systems.
• Exception tracking and retesting should be conducted after applying patches or mitigations.

Evidence notes

Evidence from the NVD and CVE Program records indicates a polynomial-time regular expression denial-of-service condition exists in crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83. Further review is needed to fully understand the vulnerability's impact and validate vendor remediation. Additional context suggests that users of crmne/ruby_llm, especially those using Ruby 3.1.x, should be aware of this vulnerability and take necessary precautions to mitigate potential attacks. The vulnerability allows for excessive CPU consumption and a denial of service through a very long crafted class, agent, or tool name.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.