PT-2026-32983 · Giskard · Giskard

CVE-2026-40319 · Published 2026-04-14 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Giskard versions prior to 1.0.2b1

Description The RegexMatching check in the giskard-checks package passes a user-supplied regular expression pattern directly to the Python re.search() function without a timeout, complexity guard, or pattern validation. A crafted regex pattern can trigger catastrophic backtracking, which is a state where the regex engine takes an exponential amount of time to determine if a string matches a pattern, causing the process to hang indefinitely and resulting in a denial of service. Exploitation requires write access to a check definition and subsequent execution of the test suite, which could impact availability in automated environments such as CI/CD pipelines. The issue is located in text matching.py within the re.search(pattern, text) call.

Recommendations Update to version 1.0.2b1 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2026-40319

GHSA-RQ2Q-4R55-9877

PYSEC-2026-2489

Affected Products

Giskard

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40319.json · Exploit
• https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-rq2q-4r55-9877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40319 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2489 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rq2q-4r55-9877 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-40319 · Vendor Advisory
• https://github.com/Giskard-AI/giskard-oss · Note
• https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1 · Note
• https://twitter.com/VulmonFeeds/status/2045229867050979377 · Twitter Post
• https://github.com/advisories/GHSA-rq2q-4r55-9877 · Note
• https://pypi.org/project/giskard-checks · Note
• https://twitter.com/CVEnew/status/2045889725760770158 · Twitter Post