What happened
crmne/ruby_llm contains CVE-2026-67991 (CVSS 7.5, High): a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x, triggerable via a very long crafted class, agent, or tool name, causing excessive CPU consumption.
Why it matters
RubyLLM is a Ruby ecosystem library for building LLM-backed applications and agents; a ReDoS in the name-normalization utility used for agent/tool naming provides a low-effort denial-of-service vector against any RubyLLM-based agent application that accepts externally-supplied tool or agent names.
Attack vector
Attacker supplies a very long, specially-crafted agent/tool/class name that triggers catastrophic backtracking in the underscore utility's regex, exhausting CPU
Affected systems
crmne/ruby_llm (commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83) on Ruby 3.1.x
Mitigation
No fixed version confirmed at time of writing; apply input length limits on agent/tool names as a workaround