Inefficient Regular Expression Complexity
This vulnerability occurs when an application uses a poorly constructed regular expression that can trigger catastrophic backtracking, leading to extreme CPU consumption and potential denial-of-service.
The root cause lies in how many regex engines handle failed matches through a process called backtracking. When a pattern doesn't match, the engine tries different paths by rewinding to earlier decision points. A poorly designed regex—often involving nested quantifiers (like (a+)+) or ambiguous patterns—can create an exponential number of these backtracking paths relative to the input length. Attackers exploit this by providing carefully crafted, non-matching input that forces the engine to evaluate all possible backtracking paths. This causes CPU usage to spike dramatically, potentially freezing the application or server. The risk is highest when processing user-controlled strings without complexity limits, making regex-based input validation a common attack vector for denial-of-service.
Impact: DoS: Resource Consumption (CPU)
Effectiveness: High
Effectiveness: Moderate
Effectiveness: High
Effectiveness: Moderate
ID : DX-158
This example attempts to check if an input string is a "sentence" [REF-1164].Code Example:
var test_string = "Bad characters: $@#"; var bad_pattern = /^(\w+\s?)*$/i; var result = test_string.search(bad_pattern);
Code Example:
var test_string = "Bad characters: $@#"; var good_pattern = /^((?=(\w+))\2\s?)*$/i; var result = test_string.search(good_pattern);
Code Example:
my $test_string = "Bad characters: $@#"; my $bdrslt = $test_string; $bdrslt =~ /^(\w+\s?)*$/i;
Code Example:
my $test_string = "Bad characters: $@#"; my $gdrslt = $test_string; $gdrslt =~ /^((?=(\w+))\2\s?)*$/i;
High