Bug 2568017 (CVE-2026-77299)
| Summary: | CVE-2026-77299 github.com/dlclark/regexp2: regexp2: Denial of Service via unbounded memory allocation during pattern matching | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akhatavk, amctagga, anjoseph, aoconnor, aos-team-art-private, asdas, asyoung, bniver, cmah, crizzo, dfreiber, dpaolell, drow, dymurray, eglynn, flucifre, gbenhaim, gmeno, gparvin, groman, gtanzill, jbalunas, jburrell, jbuscemi, jcantril, jdelft, jhollowa, jjoyce, jprabhak, jpretori, jschluet, jsherril, jupierce, kaycoth, lchilton, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, niyer, orabin, ppalepu, ppostler, prdhamdh, prichard, rhaigner, rhel-process-autobot, rjohnson, rojacob, sfeifer, sghai, sidsharm, sostapov, sthirugn, suppawar, tsze, twaugh, vereddy, vkumar, vlaad, watson-tool-maintainers, wtam, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in regexp2. A remote attacker can exploit this vulnerability by submitting a specially crafted regular expression pattern containing a large repetition quantifier applied to an empty subexpression. When evaluated, the matching engine continuously allocates memory on its internal backtracking stack without bounds, rapidly consuming system resources and causing the application to crash. This failure leads to a Denial of Service (DoS).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers onto the backtracking stack on every iteration. Because the parser accepts any repetition count up to math.MaxInt32 and the backtracking stack grows without bound, a pattern of fewer than 20 bytes matched against an empty input can force multi-gigabyte allocation and OOM-kill the process. MatchTimeout does not fully mitigate this because the memory is allocated faster than the 100 ms timeout clock can fire. This issue has been patched in version 2.3.0.