RubyLLM EUVD-2026-89427

Requires three stacked conditions: (1) the application uses crmne/ruby_llm at/around commit fa6f2798 with the regex-based <think>-tag response parsing in chat.rb and stream_accumulator.rb; (2) it runs on Ruby 3.1.x, since Ruby 3.2+ regex optimizations mitigate the backtracking; and (3) the attacker can shape the MODEL RESPONSE to include many unterminated <think> tags - a malicious or compromised model endpoint, a prompt-injection coercing such output, or a MitM on the LLM API connection. The host application exposes no direct unauthenticated network surface for this; exploitation is gated by control over the upstream model output rather than by any ruby_llm configuration. Impact is limited to CPU consumption and processing delay in the request handling the response.

All real-world signals point to a low priority despite the input CVSS of 7.5. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is network, low-complexity and unauthenticated, but the A:H (high availability impact) appears inflated: the flaw is a POLYNOMIAL-time ReDoS (CWE-1333), not exponential, and the description itself characterizes the effect as 'excessive CPU consumption' that 'delay[s] chat-completion processing' rather than a crash or sustained outage - this argues for A:L and a real base score closer to 5.3. EPSS is 0.17% (5th percentile), among the lowest tiers, consistent with no public exploit and no scanning interest. Not in CISA KEV; no POC identified. A nuance limits the PR:N framing: although ruby_llm requires no application authentication, triggering the bug requires an attacker to influence the MODEL RESPONSE (many unterminated <think> tags), which in practice means a malicious/compromised model endpoint, a prompt-injection coercing such output, or a MitM on the LLM API connection - the host app is not a direct network attack surface. Finally the condition is Ruby-version-specific: Ruby 3.1.x is affected, while Ruby 3.2+ regex linear-time/memoization optimizations largely mitigate this class. Net: low real-world risk, further gated by product obscurity and runtime version.

An application using the ruby_llm gem at the vulnerable commit on Ruby 3.1.x connects to an LLM endpoint an attacker controls or can influence (malicious provider, prompt-injected output, or MitM). The attacker returns a chat completion containing many unterminated <think> tags, driving lazy backtracking in the two think-tag parsing regexes to consume excessive CPU and delay request processing. No public exploit code or active exploitation is identified at time of analysis.