Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-15154— Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex

Quick assessment

Affected
CVE-2026-15154
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Guardrails AI Guardrails AI是Guardrails AI公司的一款信息化产品。 Guardrails AI存在资源管理错误漏洞，该漏洞源于正则表达式拒绝服务，可能导致远程攻击者提供特制正则表达式给公开检测API，引起灾难性回溯，导致工作进程无限CPU消耗，造成整个guardrails中介的LLM管道拒绝服务。

CVSS 6.5 · Medium EPSS 0.48% · P40

Affected Version Matrix 7

VendorProduct Version RangeStatus
None None < d857e059f8a2dedb5c7ea9a2c307c4cfd7983fd1 affected
Red Hat Red Hat OpenShift AI 2.25 1784230964< * unaffected
1787235925< * unaffected
Red Hat Red Hat OpenShift AI 3.3 1785137880< * unaffected
1789573032< * unaffected
Red Hat Red Hat OpenShift AI 3.4 1783569145< * unaffected
1786617316< * unaffected

I. Basic Information for CVE-2026-15154

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service (ReDoS), allows a remote attacker to provide specially crafted regular expressions to the public detection API. This can cause catastrophic backtracking, leading to a worker process consuming 100% CPU indefinitely and resulting in a denial of service for the entire guardrails-mediated LLM pipeline.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5
Vulnerability Title
Guardrails AI 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Guardrails AI Guardrails AI是Guardrails AI公司的一款信息化产品。 Guardrails AI存在资源管理错误漏洞，该漏洞源于正则表达式拒绝服务，可能导致远程攻击者提供特制正则表达式给公开检测API，引起灾难性回溯，导致工作进程无限CPU消耗，造成整个guardrails中介的LLM管道拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ d857e059f8a2dedb5c7ea9a2c307c4cfd7983fd1 -
Red Hat Red Hat OpenShift AI 2.25 1784230964 ~ * cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat Red Hat OpenShift AI 2.25 1787235925 ~ * cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat Red Hat OpenShift AI 3.3 1785137880 ~ * cpe:/a:redhat:openshift_ai:3.3::el9
Red Hat Red Hat OpenShift AI 3.3 1789573032 ~ * cpe:/a:redhat:openshift_ai:3.3::el9
Red Hat Red Hat OpenShift AI 3.4 1783569145 ~ * cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat Red Hat OpenShift AI 3.4 1786617316 ~ * cpe:/a:redhat:openshift_ai:3.4::el9

II. Public POCs for CVE-2026-15154

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-15154

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-15154 (7)

Other References for CVE-2026-15154 (1)

IV. Related Vulnerabilities

Same weakness: CWE-1333

V. Comments for CVE-2026-15154

No comments yet

Leave a comment