This is a list of useful info for real world ReDoS (AKA RegEx DoS, AKA Regular Expression Denial of Service) vulnerabilities. ReDoS is primarily caused by catastrophic backtracking (AKA evil RegEx). ReDoS vulnerabilities are interesting because they are fairly easy to verify, but at the time this repo was created, there is no "go to" tool for identifying ReDoS vulnerabilities in codebases. However, several researchers have found multiple vulnerabilities of this type.
Contributions are welcome! Updates with new CVEs are particularly helpful.
This table captures a list of real-world security issues along with the actual commit showing the before (vulnerable) and after (presumably not vulnerable) regular expressions. This information was manually collected using the NVD CVE database with queries such as "regex dos", "regex backtrack", and "regular expression denial of service". Other useful lists include this list from TU Darmstadt, this list from Yeting Li, and this list from Doyensec.
To Do: Compare these tools against the real world CVEs listed above to find the strengths and weaknesses of each tool. Or is there a "best" tool?
- https://github.com/doyensec/regexploit (last commit in 2021)
- https://www.regexbuddy.com/debug.html (last updated in 2021)
- https://github.com/jkutner/saferegex (last commit in 2020)
- https://github.com/n4o847/seccamp-redos (last commit in 2020)
- https://github.com/NicolaasWeideman/RegexStaticAnalysis (last commit in 2020)
- https://github.com/davisjam/vuln-regex-detector (last commit in 2019)
- https://github.com/gagyibenedek/ReDoS-checker (last commit in 2018)
- https://github.com/jagracey/RegEx-DoS (last commit in 2016)
- https://github.com/olivo/redos-detector (last commit in 2016)
- https://web.archive.org/web/20200825222652/https://www.cs.bham.ac.uk/~hxt/research/rxxr.shtml (last updated in 2013)