Description

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers onto the backtracking stack on every iteration. Because the parser accepts any repetition count up to math.MaxInt32 and the backtracking stack grows without bound, a pattern of fewer than 20 bytes matched against an empty input can force multi-gigabyte allocation and OOM-kill the process. MatchTimeout does not fully mitigate this because the memory is allocated faster than the 100 ms timeout clock can fire. This issue has been patched in version 2.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T02:17:52.893Z",
  "pubdate": "2026-11-06T02:17:52.893Z",
  "executiveSummary": "Regexp2 versions prior to 2.3.0 are susceptible to a memory exhaustion vulnerability stemming from improper handling of large fixed-count quantifiers on zero-width subexpressions. This flaw allows an attacker to trigger an OOM (Out-of-Memory) condition via a maliciously crafted regular expression.\nThe vulnerability type is categorized as Denial of Service (DoS) through resource exhaustion. By supplying a pattern with a massive repetition count, an attacker can force the engine to allocate significant memory on the backtracking stack, causing the host process to crash.\nThe impact is critical, as it bypasses existing protective mechanisms such as the MatchTimeout configuration, which fails to trigger before the memory exhaustion event occurs. Exploitation requires no authentication and can be performed by any user capable of providing input that is processed by the Regexp2 engine. Because the attack requires only a small payload—fewer than 20 bytes—it is highly efficient and presents a significant risk to the availability of systems using this library for input validation or text processing.",
  "technicalDetails": "The root cause of this vulnerability lies in the Regexp2 engine's handling of quantifiers applied to zero-width subexpressions, specifically when combined with the lack of bounds checking on repetition counts during the compilation phase. The parser permits repetition counts up to math.MaxInt32 regardless of the complexity or memory implications.\nWhen the engine encounters a pattern such as (?:){50000000}, it initiates a match process that executes the empty loop body m-1 times. During each iteration of this loop, the backtracking engine pushes two integers onto the backtracking stack. Because the loop body is zero-width, the engine does not consume input, but it continues to grow the stack linearly with the specified quantifier value.\nThe attack flow follows these steps: 1) The attacker submits a malicious regular expression containing an excessively large fixed-count quantifier targeting a zero-width group. 2) The Regexp2 compiler accepts the expression without validating the memory impact of the resulting execution plan. 3) Upon matching, the engine enters the loop, rapidly pushing elements onto the backtracking stack. 4) The allocation of these stack elements occurs at a rate that exhausts available system memory faster than the internal MatchTimeout (100 ms) clock interval can evaluate, rendering the timeout mechanism ineffective as a mitigation. 5) The process consumes gigabytes of memory, leading to an OOM-kill event triggered by the operating system.\nThe vulnerable component is the backtracking engine within the Regexp2 library. Affected versions include all releases prior to 2.3.0. The vulnerability does not require authentication or specific privileges, as it is exploitable via any entry point where user-controlled regular expressions are evaluated. The payload is extremely lightweight, requiring fewer than 20 bytes to trigger the vulnerability, making it an ideal vector for remote DoS attacks against applications that fail to sanitize input patterns."
}