---
id: CVE-2026-40319
aliases:
  - GHSA-rq2q-4r55-9877
  - PYSEC-2026-2489
title: >-
  Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching
  Check
summary: >-
  Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching
  Check
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
vendor: giskard-checks
product: giskard-checks
ecosystem: pip
affected:
  - giskard-checks < 1.0.2b1
patched:
  - giskard-checks 1.0.2b1
published: '2026-04-14'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-rq2q-4r55-9877'
references:
  - url: >-
      https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-rq2q-4r55-9877
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40319'
  - url: 'https://github.com/Giskard-AI/giskard-oss'
  - url: >-
      https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1
tags:
  - osv
  - pip
epss: 0.00149
epssPercentile: 0.04497
ingestedAt: '2026-07-13T18:58:02.886Z'
---

## Overview

## Summary
The RegexMatching check in the `giskard-checks` package passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout, complexity guard, or pattern validation. An attacker who can control the regex pattern or the text being matched can craft inputs that trigger catastrophic backtracking in the regex engine, causing the process to hang indefinitely and denying service to all other operations. 

`giskard-checks` is a local developer testing library. Check definitions, including the pattern parameter, are provided in application code or configuration files and executed locally. Exploitation requires write access to a check definition and subsequent execution of the test suite. The absence of a regex timeout could cause availability issues in automated environments such as CI/CD pipelines.

## Affected component
 
`text_matching.py`, line 457: `re.search(pattern, text)`
 
## Remediation
 
Upgrade to `giskard-checks` >= 1.0.2b1.
 
## Credit
 
Giskard-AI thanks @dhabaleshwar for identifying the missing timeout on regex evaluation.

## Affected packages

- `giskard-checks < 1.0.2b1`

## Remediation

Upgrade to a patched release:

- `giskard-checks 1.0.2b1`