CWE-1333Inefficient Regular Expression Complexity

Description

Common consequences· 1

• Availability — DoS: Resource Consumption (CPU)
  Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.

Potential mitigations· 4

• [Architecture and Design]Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
• [System Configuration]Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
• [Implementation]Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
• [Implementation]Limit the length of the input that the regular expression will process.

Related CAPEC attack patterns· 1

Exploits (incoming)1

(incoming)3

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.