CWE-1333: Inefficient Regular Expression Complexity
Description
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- High
- Status
- Draft
Common consequences
- Availability
DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Potential mitigations
- Architecture and DesignEffectiveness: High
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System ConfigurationEffectiveness: Moderate
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- ImplementationEffectiveness: High
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- ImplementationEffectiveness: Moderate
Limit the length of the input that the regular expression will process.