id: PYSEC-2026-2489
published: "2026-07-13T15:02:47.621781Z"
modified: "2026-07-13T16:04:07.632052Z"
aliases:
- CVE-2026-40319
- GHSA-rq2q-4r55-9877
summary: Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check
details: "## Summary\nThe RegexMatching check in the `giskard-checks` package passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout, complexity guard, or pattern validation. An attacker who can control the regex pattern or the text being matched can craft inputs that trigger catastrophic backtracking in the regex engine, causing the process to hang indefinitely and denying service to all other operations. \n\n`giskard-checks` is a local developer testing library. Check definitions, including the pattern parameter, are provided in application code or configuration files and executed locally. Exploitation requires write access to a check definition and subsequent execution of the test suite. The absence of a regex timeout could cause availability issues in automated environments such as CI/CD pipelines.\n\n## Affected component\n \n`text_matching.py`, line 457: `re.search(pattern, text)`\n \n## Remediation\n \nUpgrade to `giskard-checks` >= 1.0.2b1.\n \n## Credit\n \nGiskard-AI thanks @dhabaleshwar for identifying the missing timeout on regex evaluation."
affected:
- package:
    name: giskard-checks
    ecosystem: PyPI
    purl: pkg:pypi/giskard-checks
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.0.2b1
  versions:
  - 1.0.1a1
  - 1.0.1a2
  - 1.0.1b1
references:
- type: WEB
  url: https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-rq2q-4r55-9877
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-40319
- type: PACKAGE
  url: https://github.com/Giskard-AI/giskard-oss
- type: WEB
  url: https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1
- type: PACKAGE
  url: https://pypi.org/project/giskard-checks
- type: ADVISORY
  url: https://github.com/advisories/GHSA-rq2q-4r55-9877
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- type: CVSS_V4
  score: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L