thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Regular Expression Denial of Service (ReDoS)

A denial of service caused by a regular expression that takes exponential time to evaluate certain inputs due to catastrophic backtracking.

Definition

Patterns with nested quantifiers such as (a+)+ can hang a thread on crafted input. Mitigations include avoiding ambiguous nested quantifiers, setting regex timeouts, limiting input length and using linear-time regex engines such as RE2.

Example

An email validation regex locks a Node.js event loop for minutes on a 50-character input.

Exam tip

Single-threaded runtimes like Node.js are especially affected.

Related terms