Technical impact
The vulnerability resides in the ruby_llm library used with Ruby 3.1.x and involves polynomial‑time regular expressions that parse <think> tags. This instance of CWE-1333 involves excessive resource consumption. Crafting a model response containing many unterminated <think> tags triggers two consecutive regular expressions that consume excessive CPU time, delaying or blocking chat‑completion responses. It can lead to a denial‑of‑service by exhausting the processor resources of the application.
Affected Systems
Any deployment of the ruby_llm library that targets Ruby 3.1.x, such as an application running the reference commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83, is affected. The vendor is unlisted; the library is open‑source on GitHub under the crmne organization.
Risk and Exploitability
The EPSS score is < 1%, indicating a low probability of exploitation, and the CVSS score of 7.5 shows a high severity vulnerability. The likely attack vector involves a malicious or anomalous model response that the application processes, which could be triggered by an attacker that controls the upstream model output or that injects crafted responses. Successful exploitation would cause CPU exhaustion and prevent timely chat completions, impacting the availability of the service.
