CVE-2026-67989: Crmne ruby_llm vulnerability

Q: Which deployments are exposed to this issue?

The affected code is the Mistral model capability matching logic in crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83, when running on Ruby 3.1.x. Deployments that do not exercise this Mistral capability-matching path are not identified by the provided data as exposed.

Q: What is required to trigger the denial of service?

The issue is a polynomial-time regular expression denial-of-service condition in Mistral model capability matching. The provided data does not specify the exact input source, attacker access level, or triggering string.

Q: Is a fix identified?

A subsequent crmne/ruby_llm commit, dd3c84812598def03d4aff77b5447c41d8f5c34e, is referenced. The provided data does not state which release includes it or describe any mitigation for environments that cannot apply the fix immediately.

Published Oct 2, 2026

Updated

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x

Affected Software

2 affected components

crmne ruby_llm=fa6f279847d6d7027814539d9c0dfc3bbdfd2a83

Ruby Ruby>=3.1.0<3.2.0

Event History

Oct 2, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

The affected code is the Mistral model capability matching logic in crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83, when running on Ruby 3.1.x. Deployments that do not exercise this Mistral capability-matching path are not identified by the provided data as exposed.

What is required to trigger the denial of service?

The issue is a polynomial-time regular expression denial-of-service condition in Mistral model capability matching. The provided data does not specify the exact input source, attacker access level, or triggering string.

Is a fix identified?

A subsequent crmne/ruby_llm commit, dd3c84812598def03d4aff77b5447c41d8f5c34e, is referenced. The provided data does not state which release includes it or describe any mitigation for environments that cannot apply the fix immediately.

CVE-2026-67989: Crmne ruby_llm vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What is required to trigger the denial of service?

Is a fix identified?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What is required to trigger the denial of service?

Is a fix identified?