CVE-2026-40319Medium· 5.5▾ SunlitGiskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.1%
The RegexMatching check in the giskard-checks package passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout, complexity guard, or pattern validation. An attacker who can control the regex pattern or the text being matched can craft inputs that trigger catastrophic backtracking in the regex engine, causing the process to hang indefinitely and denying service to all other operations.
giskard-checks is a local developer testing library. Check definitions, including the pattern parameter, are provided in application code or configuration files and executed locally. Exploitation requires write access to a check definition and subsequent execution of the test suite. The absence of a regex timeout could cause availability issues in automated environments such as CI/CD pipelines.
text_matching.py, line 457: re.search(pattern, text)
Upgrade to giskard-checks >= 1.0.2b1.
Giskard-AI thanks @dhabaleshwar for identifying the missing timeout on regex evaluation.
giskard-checks < 1.0.2b1Upgrade to a patched release:
giskard-checks 1.0.2b1Connected by shared product, vendor, weakness, or advisory.