This ReDoS lives in a utility function that runs during normal operation, not in an error handler that attackers must deliberately trigger. The underscore() method converts tool and class names to Ruby conventions—it's called every time a tool is registered, which in LLM frameworks happens during normal workflow processing, not just during error conditions. This changes the threat model fundamentally: an attacker doesn't need to craft a precision payload through a narrow injection vector; they just need to submit a long enough tool name, which is trivially achievable in any system accepting user-defined tool schemas.
The Ruby 3.1.x version specificity is your strongest diagnostic artifact. This regression didn't emerge from new code—it surfaced because Ruby's regex engine changed behavior between versions. The vulnerability was likely dormant in the underscore() implementation (probably ported from ActiveSupport) and activated by the engine shift. Check whether your deployment runs ruby_llm on Ruby 3.1.x specifically, and whether your CI pipeline tests regex-heavy utilities against adversarial inputs on that version.
For multi-tenant LLM platforms, this is a high-severity vector. One tenant submitting long tool names causes CPU starvation that degrades response times for every tenant sharing the inference pipeline—collateral damage with zero causal relationship to the victim. The remediation hierarchy: first, enforce tool name length limits at the tenant-facing API boundary, not inside the utility function. Second, audit all string transformation utilities in hot code paths for similar patterns. Third, verify your Ruby version and watch for similar regressions in other regex-dependent utilities.
The deeper problem is systemic: utility functions get copied across codebases without their security assumptions. This particular transformation has surfaced as a ReDoS vector across multiple ecosystems since at least 2014. Fixing ruby_llm doesn't fix the copies living in other projects. Treat this as a signal to audit your dependency tree for string transformation utilities that may carry the same dormant vulnerability.