CVE-2026-67991

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service.

Published 2026-08-13. Last modified 2026-09-08.