Question 1

What is ReDoS (Regular Expression Denial of Service)?

Accepted Answer

ReDoS is a denial-of-service attack that exploits the worst-case complexity of regular expression engines. Certain regex patterns with nested quantifiers or overlapping alternatives cause catastrophic backtracking — where the engine tries exponentially many paths for crafted input, freezing the application or consuming all CPU resources.

Question 2

How do I prevent ReDoS attacks?

Accepted Answer

Avoid regex patterns with nested quantifiers like (a+)+ or overlapping alternatives. Use atomic groups or possessive quantifiers when supported, set timeouts on regex execution, use linear-time regex engines (like RE2), validate input length before applying regex, and test patterns with tools like regex101 or safe-regex to detect vulnerable patterns.

ReDoS (Regular Expression Denial of Service)

Challenges

Frequently Asked Questions