CVE-2026-34939: 
Python vulnerability analysis and mitigation

CVE-2026-34939 is a Regular Expression Denial of Service (ReDoS) vulnerability in PraisonAI's MCPToolIndex.search_tools() function that allows unauthenticated or low-privileged network attackers to cause a complete service outage. The vulnerability affects PraisonAI versions up to and including 4.5.89, with version 4.5.90 containing the fix. It was published by the maintainer on March 31, 2026, and added to the GitHub Advisory Database on April 1, 2026. The GitHub Advisory assigns a CVSS v3.1 score of 6.5 (Moderate) with privileges required, while Feedly's NVD-sourced data scores it 7.5 (High) with no privileges required (GitHub Advisory, PraisonAI Advisory).

The root cause is CWE-1333 (Inefficient Regular Expression Complexity): the search_tools() method in tool_index.py (line 365) accepts a caller-supplied string and passes it directly to re.compile() with no input validation, sanitization, or execution timeout. The compiled pattern is then applied against all tool names and hints in the index, meaning a crafted regex such as (a+)+$ matched against a string like 'a' * 30 + '!' triggers catastrophic backtracking in Python's re engine, consuming the thread for hundreds of seconds. Because the MCP server HTTP transport runs without an API key by default, this endpoint is reachable by any network-adjacent attacker without authentication in many default deployments (GitHub Advisory, PraisonAI Advisory).

Successful exploitation causes a complete service outage for the duration of the blocking regex evaluation — demonstrated at 376 seconds in the published PoC. Because the Python thread is fully blocked, all other requests to the MCP server are also denied service. Repeated requests can sustain the denial of service indefinitely with no recovery until the process is restarted. There is no confidentiality or integrity impact; the sole consequence is high availability loss (GitHub Advisory, PraisonAI Advisory).

A working proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating a 376-second service hang using the payload (a+)+$ against a crafted tool index entry (PraisonAI Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.04% (0.000400), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify internet- or network-accessible PraisonAI MCP server instances running versions ≤ 4.5.89. Since the HTTP transport runs without an API key by default, no credentials are needed.
2. Prepare the tool index: In a default or attacker-influenced environment, ensure the MCP tool index contains at least one entry with a name or hint consisting of repeated characters (e.g., 'a' * 30 + '!'). In many deployments this condition may already be met by legitimate tools.
3. Craft the malicious regex payload: Construct a regex pattern that triggers catastrophic backtracking, such as (a+)+$, which causes exponential backtracking when matched against strings of repeated characters followed by a non-matching character.
4. Send the crafted request: Submit the malicious regex as the query parameter to the search_tools() endpoint of the MCP server HTTP transport.
5. Achieve denial of service: The Python re engine enters catastrophic backtracking, blocking the server thread for hundreds of seconds (demonstrated at ~376 seconds). Repeat requests to sustain the outage indefinitely (PraisonAI Advisory).

• Network: Repeated HTTP requests to the MCP server's search_tools endpoint containing regex metacharacters (e.g., (, +, *, $, {) in the query parameter; unusually long-lived HTTP connections to the MCP server port.
• Process: Python process consuming 100% CPU for extended periods (hundreds of seconds) associated with the PraisonAI MCP server process; absence of normal request throughput from the MCP server during the hang.
• Logs: MCP server access logs showing requests with query strings containing patterns like (a+)+$ or similar nested quantifier constructs; absence of response log entries following such requests (indicating the thread is blocked and never returns a response).

Upgrade PraisonAI to version 4.5.90 or later, which contains the patch for this vulnerability (GitHub Advisory). As interim workarounds, operators should implement input validation and sanitization on regex patterns supplied to search_tools(), enforce execution timeouts on regex compilation and matching operations (e.g., using Python's signal-based timeout or the regex library with timeout support), and restrict network access to the MCP server HTTP transport by requiring API key authentication or placing it behind a firewall. Consider replacing user-controlled regex matching with a safer alternative such as simple substring search.

The vulnerability was reported by security researcher YeranG30 and published by the PraisonAI maintainer (MervinPraison) on March 31, 2026, with a patch released promptly in version 4.5.90 (PraisonAI Advisory). No significant broader industry commentary, social media discussion, or media coverage has been identified beyond the standard vulnerability database entries.