From d564e440928b37175017b2dace5c895e8dc9fc2d Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Mon, 14 Sep 2026 11:11:03 -0400
Subject: [PATCH 1/3] One new ruby_llm advisory

---
 gems/CVE-2026-67991.yml | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 gems/CVE-2026-67991.yml

diff --git a/gems/CVE-2026-67991.yml b/gems/CVE-2026-67991.yml
new file mode 100644
index 0000000000..50d74d36f9
--- /dev/null
+++ b/gems/CVE-2026-67991.yml
@@ -0,0 +1,38 @@
+---
+engine: ruby
+gem: ruby_llm
+cve: 2026-67991
+ghsa: 42r3-x6vx-x49x
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-67991
+title: Polynomial-Time Regular Expression Denial of Service (ReDoS) vulnerability
+date: 2026-08-13
+description: |
+  crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83
+  contains a polynomial-time regular expression denial-of-service
+  condition in RubyLLM::Utils.underscore on Ruby 3.1.x.
+  A very long crafted class, agent, or tool name can cause
+  excessive CPU consumption and a denial of service.
+
+  Update: "the helper was extracted from existing code, so released
+  gems were affected too. All three reports concern polynomial-time
+  behavior on Ruby 3.1.x; exposure depends on untrusted data reaching
+  the affected operation."
+cvss_v3: 7.5
+unaffected_versions:
+  - "< 0.0.pre42"
+patched_versions:
+  - ">= 2.0.0.r1"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-67991
+    - https://github.com/crmne/ruby_llm/releases/tag/v2.0.0.rc1
+    - https://rubygems.org/gems/ruby_llm/versions/2.0.0.rc1
+    - https://github.com/crmne/ruby_llm/commit/9d75b033d7d00c4e1baa9b0afb4828faa8bd6602
+    - https://gist.github.com/Zykis1024/9f2d68fa3fd4e3a0ab83063bbe61a8e2
+    - https://github.com/crmne/ruby_llm/blob/fa6f279847d6d7027814539d9c0dfc3bbdfd2a83/lib/ruby_llm/utils.rb#L13
+    - https://github.com/advisories/GHSA-42r3-x6vx-x49x
+notes: |
+  - cvss_v3 from nvd.nist.gov and GHSA URL
+  - 9/14/2026: Versions data and "description" update came from developer email:
+    -- "CVE-2026-67991: affected >= 0.1.0.pre42, < 2.0.0.rc1.
+        Fix: https://github.com/crmne/ruby_llm/commit/9d75b033d7d00c4e1baa9b0afb4828faa8bd6602"

From baa6a5b1d71d4803f51a9d12a530777788cc9cce Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Mon, 14 Sep 2026 11:17:11 -0400
Subject: [PATCH 2/3] Moved advisory to correct dir; removed engine field/value

---
 gems/{ => ruby_llm}/CVE-2026-67991.yml | 1 -
 1 file changed, 1 deletion(-)
 rename gems/{ => ruby_llm}/CVE-2026-67991.yml (99%)

diff --git a/gems/CVE-2026-67991.yml b/gems/ruby_llm/CVE-2026-67991.yml
similarity index 99%
rename from gems/CVE-2026-67991.yml
rename to gems/ruby_llm/CVE-2026-67991.yml
index 50d74d36f9..8b295a1742 100644
--- a/gems/CVE-2026-67991.yml
+++ b/gems/ruby_llm/CVE-2026-67991.yml
@@ -1,5 +1,4 @@
 ---
-engine: ruby
 gem: ruby_llm
 cve: 2026-67991
 ghsa: 42r3-x6vx-x49x

From 2ba0c4711852f9d64a46316cfca546c57397fb15 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Mon, 14 Sep 2026 11:55:40 -0400
Subject: [PATCH 3/3] Update CVE-2026-67991.yml with version changes

---
 gems/ruby_llm/CVE-2026-67991.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gems/ruby_llm/CVE-2026-67991.yml b/gems/ruby_llm/CVE-2026-67991.yml
index 8b295a1742..90dfe87612 100644
--- a/gems/ruby_llm/CVE-2026-67991.yml
+++ b/gems/ruby_llm/CVE-2026-67991.yml
@@ -18,9 +18,9 @@ description: |
   the affected operation."
 cvss_v3: 7.5
 unaffected_versions:
-  - "< 0.0.pre42"
+  - "< 0.1.0.pre42"
 patched_versions:
-  - ">= 2.0.0.r1"
+  - ">= 2.0.0.rc1"
 related:
   url:
     - https://nvd.nist.gov/vuln/detail/CVE-2026-67991