RubyLLM::Utils.underscore contains a polynomial-time regular expression that can be triggered by an excessively long class, agent, or tool name, leading to extreme CPU usage and a denial of service. The issue is an instance of ReDoS (CWE-1333), which compromises availability only.

The vulnerability affects the open-source project crmne/ruby_llm for Ruby 3.1.x; the offending code is present in commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83. No vendor or product name is listed beyond the GitHub repository.

The CVSS score of 7.5 is now available; the EPSS score remains unavailable, and the vulnerability is not listed in the CISA KEV catalog, so the precise exploitation score is unknown. Nevertheless, the attack can be carried out by supplying a specially crafted name string to the RubyLLM::Utils.underscore function, which is likely to occur in any component that accepts user-supplied tool, agent, or class names. The concern is purely to disrupt service availability rather than steal data or gain privileged access. Given the lack of exploitation evidence, the realistic threat level appears moderate, but the potential impact of a full denial of service warrants immediate attention.