CWE-1333
Inefficient Regular Expression Complexity
AI Translation Available
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Status
draft
Abstraction
base
Likelihood
high
Affected Platforms
Technical Details
AI Translation
Common Consequences
availability
Impacts
dos: resource consumption (cpu)
Detection Methods
automated static analysis
Potential Mitigations
Phases:
architecture and design
system configuration
implementation
Descriptions:
•
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
•
Limit the length of the input that the regular expression will process.
•
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
•
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.