Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check
Summary
The RegexMatching check in the giskard-checks package passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout, complexity guard, or pattern validation. An attacker who can control the regex pattern or the text being matched can craft inputs that trigger catastrophic backtracking in the regex engine, causing the process to hang indefinitely and denying service to all other operations.
giskard-checks is a local developer testing library. Check definitions, including the pattern parameter, are provided in application code or configuration files and executed locally. Exploitation requires write access to a check definition and subsequent execution of the test suite. The absence of a regex timeout could cause availability issues in automated environments such as CI/CD pipelines.
Affected component
text_matching.py, line 457: re.search(pattern, text)
Remediation
Upgrade to giskard-checks >= 1.0.2b1.
Credit
Giskard-AI thanks @dhabaleshwar for identifying the missing timeout on regex evaluation.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | giskard-checks | < 1.0.2b1 | 1.0.2b1 |
References
- https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-rq2q-4r55-9877
- https://nvd.nist.gov/vuln/detail/CVE-2026-40319
- https://github.com/Giskard-AI/giskard-oss
- https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1
- https://pypi.org/project/giskard-checks
- https://github.com/advisories/GHSA-rq2q-4r55-9877
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-1333- Platform
- Python (PyPI)
- Package
giskard-checks- Disclosed
- 14.04.2026
- Updated
- 11.10.2026 14:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2489 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-rq2q-4r55-9877 - CC BY 4.0
Vulnerability history: giskard-checks
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 04.2026 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 1
- Low 1
Disclosures per year
- 2026: 2
-
Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.