ReDoS in guardrails-detectors (Red Hat OpenShift AI)
CVE-2026-15154 Published on July 8, 2026
Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex
A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service (ReDoS), allows a remote attacker to provide specially crafted regular expressions to the public detection API. This can cause catastrophic backtracking, leading to a worker process consuming 100% CPU indefinitely and resulting in a denial of service for the entire guardrails-mediated LLM pipeline.
Vulnerability Analysis
Timeline
Reported to Red Hat.
Made public. 12 days later.
Weakness Type
What is a ReDoS Vulnerability?
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match. Backtracking becomes a weakness if all of these conditions are met:
CVE-2026-15154 has been classified to as a ReDoS vulnerability or weakness.
Products Associated with CVE-2026-15154
Want to know whenever a new CVE is published for Red Hat Openshift Ai? stack.watch will email you.
