Regex Denial of Service in Giskard Open-Source Testing Framework
CVE-2026-40319

1LOW

Key Information:

Vendor

Giskard-ai

Status
Giskard-oss
Vendor
CVE Published:
17 April 2026

What is CVE-2026-40319?

The Giskard open-source testing framework for AI models has a significant vulnerability where the RegexMatching check can inadvertently allow a user to supply a regex pattern directly to Python's re.search() function without any time limits or complexity restrictions. This can lead to catastrophic backtracking, causing the system to become unresponsive and hang indefinitely. The exploitation requires the attacker to have write access to a check definition before executing the test suite. This issue has been effectively resolved in Giskard version 1.0.2b1.

Affected Version(s)

giskard-oss < 1.0.2b1

References

https://github.com/Giskard-AI/giskard-oss/security/adviso...
x_refsource_CONFIRM
https://github.com/Giskard-AI/giskard-oss/releases/tag/gi...
x_refsource_MISC

CVSS V4

Score:
1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.