CVE-2026-40319

OVERVIEW: CVE-2026-40319 affects Giskard, an open-source testing framework for AI models, in versions prior to 1.0.2b1. The vulnerability exists in the RegexMatching check component, which fails to implement safeguards when processing user-supplied regular expression patterns, allowing malicious regex patterns to trigger catastrophic backtracking and cause denial of service. SEVERITY: The attack requires write access to check definitions, indicating a moderate barrier to exploitation that limits the threat to authenticated or insider actors. The crafted regex pattern causes the process to hang indefinitely, resulting in application-level denial of service. The FAUCET Risk Score of 22.0/100 and exceptionally low EPSS score of 0.00007 suggest this is a low-risk vulnerability in practical terms, likely due to the access requirements and limited attack surface. EXPLOITATION STATUS: There is no indication of active exploitation, as evidenced by the vulnerability's absence from the Known Exploited Vulnerabilities (KEV) catalog and its inactive status on threat hot lists. The vulnerability has been patched in giskard-checks version 1.0.2b1, and community attention appears minimal given the low EPSS and risk scores.