CVE-2026-40319
Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check
Vexday Risk Score
8Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 1EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
17 Apr 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the RegexMatching check passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout or complexity guard. A crafted regex pattern can trigger catastrophic backtracking, causing the process to hang indefinitely. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Affected products
Giskard-AI · giskard-ossWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →