CWE-1333: Inefficient Regular Expression Complexity (Base)

Description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Extended Description: Some regular expression engines have a feature called backtracking. If the token cannot match, the engine backtracks to a position that may result in a different token that can match. Backtracking becomes a weakness if all of these conditions are met: The number of possible backtracking attempts are exponential relative to the length of the input. The input can fail to match the regular expression. The input can be long enough. Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.


Alternate Terms: ::TERM:ReDoS:DESCRIPTION:ReDoS is an abbreviation of Regular expression Denial of Service.::TERM:Regular Expression Denial of Service:DESCRIPTION:While this term is attack-focused, this is commonly used to describe the weakness.::TERM:Catastrophic backtracking:DESCRIPTION:This term is used to describe the behavior of the regular expression as a negative technical impact.::

Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:A RegEx can be easy to create and read using unbounded matching characters, but the programmer might not consider the risk of excessive backtracking.::



Common Consequences: ::SCOPE:Availability:IMPACT:DoS: Resource Consumption (CPU):LIKELIHOOD:High::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.:EFFECTIVENESS:High::PHASE:System Configuration:DESCRIPTION:Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.:EFFECTIVENESS:Moderate::PHASE:Implementation:DESCRIPTION:Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.:EFFECTIVENESS:High::PHASE:Implementation:DESCRIPTION:Limit the length of the input that the regular expression will process.:EFFECTIVENESS:Moderate::

Observed Examples: ::REFERENCE:CVE-2020-5243:DESCRIPTION:server allows ReDOS with crafted User-Agent strings, due to overlapping capture groups that cause excessive backtracking.:LINK:https://www.cve.org/CVERecord?id=CVE-2020-5243::REFERENCE:CVE-2021-21317:DESCRIPTION:npm package for user-agent parser prone to ReDoS due to overlapping capture groups:LINK:https://www.cve.org/CVERecord?id=CVE-2021-21317::REFERENCE:CVE-2019-16215:DESCRIPTION:Markdown parser uses inefficient regex when processing a message, allowing users to cause CPU consumption and delay preventing processing of other messages.:LINK:https://www.cve.org/CVERecord?id=CVE-2019-16215::REFERENCE:CVE-2019-6785:DESCRIPTION:Long string in a version control product allows DoS due to an inefficient regex.:LINK:https://www.cve.org/CVERecord?id=CVE-2019-6785::REFERENCE:CVE-2019-12041:DESCRIPTION:Javascript code allows ReDoS via a long string due to excessive backtracking.:LINK:https://www.cve.org/CVERecord?id=CVE-2019-12041::REFERENCE:CVE-2015-8315:DESCRIPTION:ReDoS when parsing time.:LINK:https://www.cve.org/CVERecord?id=CVE-2015-8315::REFERENCE:CVE-2015-8854:DESCRIPTION:ReDoS when parsing documents.:LINK:https://www.cve.org/CVERecord?id=CVE-2015-8854::REFERENCE:CVE-2017-16021:DESCRIPTION:ReDoS when validating URL.:LINK:https://www.cve.org/CVERecord?id=CVE-2017-16021::