PraisonAI versions before 4.5.90 contain an inefficient regular expression complexity vulnerability (CWE-1333) in the MCPToolIndex.search_tools() function. This function compiles caller-supplied strings as Python regex patterns without any validation, sanitization, or timeout controls. Maliciously crafted regex inputs can trigger catastrophic backtracking in the Python regex engine, leading to prolonged blocking of the Python thread and causing a complete denial of service. The vulnerability affects availability but not confidentiality or integrity. The issue has been patched in PraisonAI version 4.5.90.

Exploitation of this vulnerability results in denial of service by causing the Python thread to block for hundreds of seconds due to catastrophic backtracking in regex processing. This leads to a complete service outage of PraisonAI instances running affected versions. There is no impact on confidentiality or integrity of data. No known exploits are reported in the wild.

Upgrade PraisonAI to version 4.5.90 or later, where this vulnerability has been patched. Since the vendor advisory confirms the issue is fixed in this version, applying this official fix fully mitigates the risk. No additional mitigations are specified or required.