The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
Backtracking becomes a weakness if all of these conditions are met:

The number of possible backtracking attempts are exponential relative to the length of the input.
The input can fail to match the regular expression.
The input can be long enough.

Attackers can create crafted inputs that
intentionally cause the regular expression to use
excessive backtracking in a way that causes the CPU
consumption to spike.

Primary

ReDoS
ReDoS is an abbreviation of "Regular expression Denial of Service".

Regular Expression Denial of Service
While this term is attack-focused, this is commonly used to describe the weakness.

Catastrophic backtracking
This term is used to describe the behavior of the regular expression as a negative technical impact.

Implementation
A RegEx can be easy to create and read using unbounded matching characters, but the programmer might not consider the risk of excessive backtracking.

High

Availability
DoS: Resource Consumption (CPU)
High

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
High
This is one of the few effective solutions when using user-provided regular expressions.

System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Moderate

Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
High

Implementation
Limit the length of the input that the regular expression will process.
Moderate

This example attempts to check if an input string is a "sentence" [REF-1164].

var test_string = "Bad characters: $@#";
var bad_pattern = /^(\w+\s?)*$/i;
var result = test_string.search(bad_pattern);

The regular expression has a vulnerable backtracking clause inside (\w+\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases.
To fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \2 which prevents the backtracking. The modified example is:

var test_string = "Bad characters: $@#";
var good_pattern = /^((?=(\w+))\2\s?)*$/i;
var result = test_string.search(good_pattern);

Note that [REF-1164] has a more thorough (and lengthy) explanation of everything going on within the RegEx.

This example attempts to check if an input string is a "sentence" and is modified for Perl [REF-1164].

my $test_string = "Bad characters: \$\@\#";
my $bdrslt = $test_string;
$bdrslt =~ /^(\w+\s?)*$/i;

The regular expression has a vulnerable backtracking clause inside (\w+\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases.
To fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \2 which prevents the backtracking. The modified example is:

my $test_string = "Bad characters: \$\@\#";
my $gdrslt = $test_string;
$gdrslt =~ /^((?=(\w+))\2\s?)*$/i;

Note that [REF-1164] has a more thorough (and lengthy) explanation of everything going on within the RegEx.

CVE-2020-5243
server allows ReDOS with crafted User-Agent strings, due to overlapping capture groups that cause excessive backtracking.
https://www.cve.org/CVERecord?id=CVE-2020-5243

CVE-2021-21317
npm package for user-agent parser prone to ReDoS due to overlapping capture groups
https://www.cve.org/CVERecord?id=CVE-2021-21317

CVE-2019-16215
Markdown parser uses inefficient regex when processing a message, allowing users to cause CPU consumption and delay preventing processing of other messages.
https://www.cve.org/CVERecord?id=CVE-2019-16215

CVE-2019-6785
Long string in a version control product allows DoS due to an inefficient regex.
https://www.cve.org/CVERecord?id=CVE-2019-6785

CVE-2019-12041
Javascript code allows ReDoS via a long string due to excessive backtracking.
https://www.cve.org/CVERecord?id=CVE-2019-12041

CVE-2015-8315
ReDoS when parsing time.
https://www.cve.org/CVERecord?id=CVE-2015-8315

CVE-2015-8854
ReDoS when parsing documents.
https://www.cve.org/CVERecord?id=CVE-2015-8854

CVE-2017-16021
ReDoS when validating URL.
https://www.cve.org/CVERecord?id=CVE-2017-16021

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Anonymous External Contributor
2021-01-17
4.4
2021-03-15

CWE Content Team
MITRE
2021-07-20
updated References

CWE Content Team
MITRE
2021-10-28
updated Description

CWE Content Team
MITRE
2022-04-28
updated Observed_Examples, Potential_Mitigations

CWE Content Team
MITRE
2022-10-13
updated Observed_Examples, Relationships

CWE Content Team
MITRE
2023-01-31
updated Demonstrative_Examples, Observed_Examples

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Detection_Factors, Weakness_Ordinalities