# Analyzing and Discovering Spatial Algorithm Complexity Vulnerabilities in Recursion
## 5 Evaluation
### Result and Analysis
#### 5.2.3 RQ3: Verification and Exploitation
The algorithm pseudocode and proof of authorized CVE identifiers are publicly available at [[https://github.com/BIngDiAn-s/ACV_Find_Method](https://github.com/BIngDiAn-s/ACV_Find_Method)]([https://github.com/BIngDiAn-s/ACV_Find_Method](https://github.com/BIngDiAn-s/ACV_Find_Method)) (accessed on 8 January 2024). The authorized CVEs mentioned in this study are openly available in [41; 42; 43; 44; 45; 46; 47; 48], other data presented in this article are not readily available because the data are part of an ongoing study. The authors declare no conflicts of interest. ## References

* [1] Algorithmic Complexity Vulnerabilities: An Introduction. Available online: [[https://twosixtech.com/blog/algorithmic-complexity-vulnerabilities-an-introduction/](https://twosixtech.com/blog/algorithmic-complexity-vulnerabilities-an-introduction/)]([https://twosixtech.com/blog/algorithmic-complexity-vulnerabilities-an-introduction/](https://twosixtech.com/blog/algorithmic-complexity-vulnerabilities-an-introduction/)) (accessed on 8 January 2024). * [2] Zip Bomb. Available online: [[https://en.wikipedia.org/wiki/Zip_bomb](https://en.wikipedia.org/wiki/Zip_bomb)]([https://en.wikipedia.org/wiki/Zip_bomb](https://en.wikipedia.org/wiki/Zip_bomb)) (accessed on 8 January 2024). * [3] 42.zip. Available online: [[https://www.unforgettable.dk/](https://www.unforgettable.dk/)]([https://www.unforgettable.dk/](https://www.unforgettable.dk/)) (accessed on 8 January 2024). * [4] Regular Expression Denial of Service--ReDoS. Available online: [[https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_._ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_._ReDoS)]([https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_._ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_._ReDoS)) (accessed on 8 January 2024). * [5] [PERSON]; [PERSON]; [PERSON] Static Analysis for Regular Expression Denial-of-Service Attacks. In Proceedings of the International Conference on Network and System Security, Madrid, Spain, 3-4 June 2013; [PERSON], [PERSON], [PERSON]; Springer. Berlin/Heidelberg, Germany, 2013; pp. 135-148. * [6] [PERSON]; [PERSON]; [PERSON]; [PERSON] Static Detection of DoS Vulnerabilities in Programs That Use Regular Expressions. In Proceedings of the 23 rd International Conference on Tools and Algorithms for the Construction and Analysis of Systems, Uppsala, Sweden, 22-29 April 2017, Proceedings, Part II; Springer: Berlin/Heidelberg, Germany, 2017; Volume 10206, pp. 3-20. [CrossRef]
* [7] [PERSON]; [PERSON]; [PERSON]; [PERSON] The impact of regular expression denial of service (ReDoS) in practice: An empirical study at the ecosystem scale. In Proceedings of the 2018 26 th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Lake Buena Vista, FL, USA, 4-9 November 2018; pp. 246-256. [CrossRef]
* [8] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; et al. Effective ReDoS Detection by Principed Vulnerability Modeling and Exploit Generation. In Proceedings of the 2023 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA, 22-24 May 2023; pp. 2427-2443. [CrossRef]
* [9] [PERSON]; [PERSON] Freezing the web: A study of ReDoS vulnerabilities in Javascript-based web servers. In Proceedings of the 27 th USENIX Conference on Security Symposium (SEC'18), Baltimore, MD, USA, 15-17 August 2018; pp. 361-376. * [10] CVE-2023-36617 Detail. Available online: [[https://nvd.nist.gov/vuln/detail/CVE-2023-36617](https://nvd.nist.gov/vuln/detail/CVE-2023-36617)]([https://nvd.nist.gov/vuln/detail/CVE-2023-36617](https://nvd.nist.gov/vuln/detail/CVE-2023-36617)) (accessed on 8 January 2024). * [11] [PERSON]; [PERSON] Acquirer: A Hybrid Approach to Detecting Algorithmic Complexity Vulnerabilities. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS '22), Los Angeles, CA, USA, 7-11 November 2022; pp. 2071-2084.