Home / Knowledge hub / ReDoS
Knowledge hub
ReDoS
A pattern match that takes enormous time on crafted input and freezes the app.
What it means
ReDoS, short for regular expression denial of service, happens when a pattern match takes far longer than it should on certain input. Some regular expressions can try an enormous number of ways to match a string before giving up. OWASP classes it as an algorithmic complexity attack that can leave a service unresponsive.
The pattern itself looks innocent, and on normal input it finishes in microseconds. A short string built to hit the worst case can keep the same pattern busy for minutes. In a single-threaded runtime such as Node.js, one stuck match blocks the other requests queued behind it.
Why it matters
A small request that ties up a processor is cheaper for an attacker than flooding you with traffic, and harder for you to spot. Nothing looks unusual on the network. Monitoring shows one worker at full load while pages stop loading, and rate limits do little because only a few requests are needed.
The result is the same as any denial of service. Customers cannot check out, sign in or reach support, and your team spends the incident hunting for a traffic spike that never happened. If the weak pattern sits in a shared library or gateway, one input can stall a service that many products depend on.
How it shows up
You meet it wherever text is checked with a regular expression: email and phone validation, URL routing, search boxes, markdown rendering, log parsers and filtering rules. The risky shapes are nested repetition, a repeated group inside another repeat, and alternatives that overlap. Patterns copied from forums and old snippets are a common source.
The mistakes repeat. The field being checked has no length limit, so the input can be megabytes long, and the pattern was only tested with well-formed samples. Cap the length before matching, prefer engines that guarantee linear time, set a timeout on matching, and test with long near-miss strings. Good input validation should be cheap by design.
Questions people ask
ReDoS, answered
Is ReDoS the same as a normal denial of service attack?
No, though the outcome is the same. A normal flood needs a lot of traffic. ReDoS needs very little, because one request makes the server do an unreasonable amount of work.
That makes it quieter and cheaper to launch, and it can look like a bug rather than an attack.
Which regular expressions are vulnerable?
Those where the engine can backtrack through many combinations, usually through nested quantifiers or overlapping alternatives. A pattern like a repeated group that itself contains a repeat is the classic shape.
Not every complicated pattern is a problem. The test is how the match time grows as the input gets longer.
Does a web application firewall stop it?
Not reliably. The firewall cannot tell that a perfectly ordinary-looking string will make your pattern slow, and its own rules may contain the weak pattern.
The dependable fixes sit in your code: input limits, safer patterns and match timeouts.
How do we fix a vulnerable pattern?
Rewrite it so there is only one way to match each part, limit the input length, or switch to a regular expression engine that runs in linear time. Some runtimes allow a match timeout, which is a sensible backstop.
How do we test for ReDoS?
Send long strings that almost match the pattern, and watch how response time grows as the string gets longer. A steep curve is the finding.
Static analysis can flag risky patterns, but only a timed request against the running app shows whether the slow path is reachable.
Sources
Where this comes from
Related
Terms that sit next to this one
Denial of service
Making an application unavailable by overwhelming or exhausting it.
Input validation
Checking that what arrives is the shape and range you expected.
Rate limiting
Capping how often something can be attempted, per user or per address.
Unrestricted resource consumption
API calls that can use unlimited CPU, memory, money or third-party credits.
Fuzzing
Throwing malformed input at an application to see what falls over.
How long does one request take?
Slow paths that one crafted request can trigger are the sort of thing we look for in a running app, and a finding carries the request and the measured response time. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.