Updated advisory posts against rubysec/ruby-advisory-db@44784c2

Author: jasnow

advisories/_posts/2026-08-13-CVE-2026-67991.md

@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2026-67991 (ruby_llm): Polynomial-Time Regular Expression Denial of Service
+  (ReDoS) vulnerability'
+comments: false
+categories:
+- ruby_llm
+advisory:
+  gem: ruby_llm
+  cve: 2026-67991
+  ghsa: 42r3-x6vx-x49x
+  url: https://nvd.nist.gov/vuln/detail/CVE-2026-67991
+  title: Polynomial-Time Regular Expression Denial of Service (ReDoS) vulnerability
+  date: 2026-08-13
+  description: |-
+    crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83
+    contains a polynomial-time regular expression denial-of-service
+    condition in RubyLLM::Utils.underscore on Ruby 3.1.x.
+    A very long crafted class, agent, or tool name can cause
+    excessive CPU consumption and a denial of service.
+
+    Update: "the helper was extracted from existing code, so released
+    gems were affected too. All three reports concern polynomial-time
+    behavior on Ruby 3.1.x; exposure depends on untrusted data reaching
+    the affected operation."
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 0.1.0.pre42"
+  patched_versions:
+  - ">= 2.0.0.rc1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-67991
+    - https://github.com/crmne/ruby_llm/releases/tag/v2.0.0.rc1
+    - https://rubygems.org/gems/ruby_llm/versions/2.0.0.rc1
+    - https://github.com/crmne/ruby_llm/commit/9d75b033d7d00c4e1baa9b0afb4828faa8bd6602
+    - https://gist.github.com/Zykis1024/9f2d68fa3fd4e3a0ab83063bbe61a8e2
+    - https://github.com/crmne/ruby_llm/blob/fa6f279847d6d7027814539d9c0dfc3bbdfd2a83/lib/ruby_llm/utils.rb#L13
+    - https://github.com/advisories/GHSA-42r3-x6vx-x49x
+  notes: |
+    - cvss_v3 from nvd.nist.gov and GHSA URL
+    - 9/14/2026: Versions data and "description" update came from developer email:
+      -- "CVE-2026-67991: affected >= 0.1.0.pre42, < 2.0.0.rc1.
+          Fix: https://github.com/crmne/ruby_llm/commit/9d75b033d7d00c4e1baa9b0afb4828faa8bd6602"
+---