{"id":"CVE-2026-77299","kind":"vulnerability","aliases":["CVE-2026-77299"],"related":[],"title":"Regexp2 Go library: short pattern exhausts memory and crashes process","description":"Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers onto the backtracking stack on every iteration. Because the parser accepts any repetition count up to math.MaxInt32 and the backtracking stack grows without bound, a pattern of fewer than 20 bytes matched against an empty input can force multi-gigabyte allocation and OOM-kill the process. MatchTimeout does not fully mitigate this because the memory is allocated faster than the 100 ms timeout clock can fire. This issue has been patched in version 2.3.0.","summary":"Regexp2, a RegExp engine for Go, lets a pattern under 20 bytes with a huge repeat count on an empty group make the matcher allocate gigabytes of memory. An attacker who can supply the pattern can crash the process by running out of memory.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","package","regexp2","user-supplied-patterns"],"not_affected_if":["fixed-patterns-only","regexp2-2.3.0-or-later"],"how_to_check":"- Check the version of `github.com/dlclark/regexp2` in `go.mod` or `go list -m github.com/dlclark/regexp2`\n- Look for code that compiles user-supplied patterns with regexp2","fix":"- `github.com/dlclark/regexp2` version `2.3.0`","status":"open","published_at":"2026-11-06T02:17:52+00:00","first_seen_at":"2026-11-06T02:32:55+00:00","triaged_at":"2026-11-06T02:35:04+00:00","updated_at":"2026-11-06T02:35:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T02:35:04Z","model":"claude-haiku-5-5","output":{"fix":"- `github.com/dlclark/regexp2` version `2.3.0`","reach":"unknown","title":"Regexp2 Go library: short pattern exhausts memory and crashes process","impact":"medium","summary":"Regexp2, a RegExp engine for Go, lets a pattern under 20 bytes with a huge repeat count on an empty group make the matcher allocate gigabytes of memory. An attacker who can supply the pattern can crash the process by running out of memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","regexp2","user-supplied-patterns"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Process is killed by out-of-memory, causing denial of service","analyst_note":"","how_to_check":"- Check the version of `github.com/dlclark/regexp2` in `go.mod` or `go list -m github.com/dlclark/regexp2`\n- Look for code that compiles user-supplied patterns with regexp2","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-patterns-only","regexp2-2.3.0-or-later"],"who_is_affected":"Applications that compile or match regular expressions written by untrusted users with regexp2 before version 2.3.0. Programs that only use fixed, developer-written patterns are much less exposed. MatchTimeout does not prevent this, so it is not a workaround.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4421,"output_tokens":528,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':114C '-2026':12A,15A '-77299':13A,16A '100':181C '2.3.0':81C,194C '20':34B,148C '50000000':104C 'accept':129C 'alloc':48B,160C,177C 'appli':96C 'attack':53B 'backtrack':121C,138C 'bodi':112C 'bound':142C 'byte':35B,149C 'clock':184C 'compil':84C 'contain':89C 'count':40B,94C,132C 'crash':9A,60B 'cve':11A,14A 'e.g':103C 'empti':43B,110C,153C 'engin':27B,75C,107C 'everi':124C 'execut':108C 'exhaust':6A 'faster':178C 'featur':72C 'feature-rich':71C 'fewer':146C 'fire':186C 'fix':93C 'fixed-count':92C 'forc':156C 'fulli':170C 'gigabyt':49B,159C 'go':2A,17B,29B,77C 'group':44B 'grow':140C 'huge':38B 'input':154C 'integ':118C 'issu':188C 'iter':125C 'kill':164C 'larg':91C 'let':30B 'librari':3A 'loop':111C 'm':113C 'make':45B 'match':86C,106C,150C 'matcher':47B 'matchtimeout':167C 'math.maxint32':135C 'memori':7A,51B,67B,175C 'mitig':171C 'ms':182C 'multi':158C 'multi-gigabyt':157C 'onto':119C 'oom':163C 'oom-kil':162C 'packag':18B 'parser':128C 'patch':191C 'pattern':5A,23B,32B,58B,88C,144C 'prior':78C 'process':10A,62B,166C 'push':116C 'quantifi':95C 'regexp':26B,74C 'regexp2':1A,19B,24B,68C,83C 'repeat':39B 'repetit':131C 'rich':73C 'run':64B 'short':4A 'stack':122C,139C 'subexpress':102C 'suppli':22B,56B 'time':115C 'timeout':183C 'two':117C 'user':21B 'user-supplied-pattern':20B 'version':80C,193C 'width':101C 'without':141C 'zero':100C 'zero-width':99C","nicknames":[],"mitigations":[],"who_affected":"Applications that compile or match regular expressions written by untrusted users with regexp2 before version 2.3.0. Programs that only use fixed, developer-written patterns are much less exposed. MatchTimeout does not prevent this, so it is not a workaround.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["go","high","package","regexp2","usersuppliedpatterns"],"campaign_type":null,"search_a":"'-2026':12A,15A '-77299':13A,16A 'crash':9A 'cve':11A,14A 'exhaust':6A 'go':2A 'librari':3A 'memori':7A 'pattern':5A 'process':10A 'regexp2':1A 'short':4A","search_b":"'20':34B 'alloc':48B 'attack':53B 'byte':35B 'count':40B 'crash':60B 'empti':43B 'engin':27B 'gigabyt':49B 'go':17B,29B 'group':44B 'huge':38B 'let':30B 'make':45B 'matcher':47B 'memori':51B,67B 'packag':18B 'pattern':23B,32B,58B 'process':62B 'regexp':26B 'regexp2':19B,24B 'repeat':39B 'run':64B 'suppli':22B,56B 'user':21B 'user-supplied-pattern':20B","search_c":"'-1':114C '100':181C '2.3.0':81C,194C '20':148C '50000000':104C 'accept':129C 'alloc':160C,177C 'appli':96C 'backtrack':121C,138C 'bodi':112C 'bound':142C 'byte':149C 'clock':184C 'compil':84C 'contain':89C 'count':94C,132C 'e.g':103C 'empti':110C,153C 'engin':75C,107C 'everi':124C 'execut':108C 'faster':178C 'featur':72C 'feature-rich':71C 'fewer':146C 'fire':186C 'fix':93C 'fixed-count':92C 'forc':156C 'fulli':170C 'gigabyt':159C 'go':77C 'grow':140C 'input':154C 'integ':118C 'issu':188C 'iter':125C 'kill':164C 'larg':91C 'loop':111C 'm':113C 'match':86C,106C,150C 'matchtimeout':167C 'math.maxint32':135C 'memori':175C 'mitig':171C 'ms':182C 'multi':158C 'multi-gigabyt':157C 'onto':119C 'oom':163C 'oom-kil':162C 'parser':128C 'patch':191C 'pattern':88C,144C 'prior':78C 'process':166C 'push':116C 'quantifi':95C 'regexp':74C 'regexp2':68C,83C 'repetit':131C 'rich':73C 'stack':122C,139C 'subexpress':102C 'time':115C 'timeout':183C 'two':117C 'version':80C,193C 'width':101C 'without':141C 'zero':100C 'zero-width':99C","first_public_at":"2026-07-11T19:19:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77299","severity":null,"published_at":"2026-11-06T02:17:52+00:00","modified_at":"2026-11-06T02:17:52+00:00","first_seen_at":"2026-11-06T02:32:55+00:00","fetched_at":"2026-11-06T02:32:55+00:00","note":null}],"documents":[{"id":82505,"url":"https://github.com/dlclark/regexp2/commit/6e446cb3a57a0f20112bc24353604fd00bdb309a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":82506,"url":"https://github.com/dlclark/regexp2/releases/tag/v2.3.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":82507,"url":"https://github.com/dlclark/regexp2/security/advisories/GHSA-wq9v-j77v-qr26","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-11T19:19:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}