Regular Expression Denial of Service (ReDoS)
Regular Expression Denial of Service (ReDoS) is a vulnerability where a poorly written regular expression takes exponential time to evaluate certain inputs, allowing an attacker to send a short crafted string that consumes CPU for seconds or minutes and stalls or crashes the service.
Regular Expression Denial of Service (ReDoS) exploits how many regex engines match patterns using backtracking. When a pattern contains ambiguous, nested, or overlapping quantifiers — classic "evil regex" shapes like (a+)+, (a|a)*, or (.*a){n} — the engine can explore an exponentially growing number of ways to match a non-matching input. A carefully chosen input of only a few dozen characters can then force millions of backtracking steps, pinning a CPU core.
Because a single request can occupy a thread for a long time, ReDoS turns an input-validation routine into a denial-of-service vector: an attacker submits crafted values to any field validated by a vulnerable regex (email, URL, or other user input) and exhausts server capacity with minimal effort. It is cataloged as CWE-1333 (inefficient regular expression complexity) and CWE-400 (uncontrolled resource consumption).
Developers reduce ReDoS risk by avoiding nested and ambiguous quantifiers, preferring linear-time regex engines or libraries built on automata (RE2-style) that guarantee no catastrophic backtracking, applying input length limits and evaluation timeouts, and auditing both first-party patterns and those embedded in dependencies. Rewriting an evil regex into an unambiguous form is often the simplest durable fix.