Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-11-06T01:28:58 github.com/dlclark/regexp2: regexp2: Denial of Service via unbounded memory allocation during pattern matching 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers onto the backtracking stack on every iteration. Because the parser accepts any repetition count up to math.MaxInt32 and the backtracking stack grows without bound, a pattern of fewer than 20 bytes matched against an empty input can force multi-gigabyte allocation and OOM-kill the process. MatchTimeout does not fully mitigate this because the memory is allocated faster than the 100 ms timeout clock can fire. This issue has been patched in version 2.3.0.

A flaw was found in regexp2. A remote attacker can exploit this vulnerability by submitting a specially crafted regular expression pattern containing a large repetition quantifier applied to an empty subexpression. When evaluated, the matching engine continuously allocates memory on its internal backtracking stack without bounds, rapidly consuming system resources and causing the application to crash. This failure leads to a Denial of Service (DoS).

This vulnerability is rated as an Important severity because it enables remote attackers to crash consuming Go applications or services through rapid memory exhaustion without authentication. Applications utilizing regexp2 are susceptible when they compile or evaluate untrusted, user-controlled regular expressions. In typical Red Hat environments, Go services parsing arbitrary expressions directly from network clients face service termination via out-of-memory errors, whereas deployments that restrict pattern definitions to trusted administrative inputs remain unaffected. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce computational budget and backtracking depth limits within regexp2 or disallow untrusted user-supplied patterns: upgrade to regexp2 2.3.0 (or the corresponding fixed Red Hat builds), which enforce a default limit of 100,000 slots on the backtracking stack via OptionMaxBacktrackingStackSize and optimize away repeated literal empty expressions, closing crafted regular expression with large repetition quantifier on empty subexpression. Until patched, this is only a concern on Go applications compiling or matching untrusted, user-supplied regular expressions using regexp2 — deployments restricting pattern definitions to trusted administrative inputs are unaffected — so validate incoming patterns to reject large quantifier values and zero-width repetitions, and restrict regular expression compilation exclusively to trusted administrative inputs. As a compensating measure, enforce per-process address space limits (RLIMIT_AS) via ulimit or prlimit to constrain memory consumed by the backtracking stack, reject regular expression inputs containing repetition quantifiers that exceed safe application-defined bounds before passing them to regexp2, and apply cgroups v2 resource limits to bound container memory usage and prevent host-wide memory starvation. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory allocation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high) Red Hat Hardened Images 2026-11-10T00:00:00Z RHSA-2026:97885 trivy-main-0.76.1-0.3.hum1 Red Hat Hardened Images 2026-11-10T00:00:00Z RHSA-2026:98019 loki3-6-main-3.6.20-0.2.hum1 Red Hat Hardened Images 2026-11-12T00:00:00Z RHSA-2026:99590 hugo-main-0.169.0-0.2.hum1 Logging Subsystem for Red Hat OpenShift Under investigation openshift-logging/logging-loki-rhel9 Migration Toolkit for Applications 8 Under investigation mta/mta-analyzer-addon-rhel9 Migration Toolkit for Applications 8 Under investigation mta/mta-cli-rhel9 Migration Toolkit for Applications 8 Under investigation mta/mta-go-external-provider-rhel9 Migration Toolkit for Applications 8 Under investigation mta/mta-java-external-provider-rhel9 Migration Toolkit for Applications 8 Under investigation mta/mta-nodejs-external-provider-rhel9 Migration Toolkit for Applications 8 Under investigation mta/mta-python-external-provider-rhel9 Migration Toolkit for Applications 8 Under investigation mta/mta-solution-server-rhel9 Multicluster Global Hub Under investigation multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Multicluster Global Hub 5 Under investigation multicluster-globalhub/multicluster-globalhub-grafana-rhel9 OpenShift Service Mesh 3 Under investigation istio-proxy OpenShift Service Mesh 3 Under investigation openshift-service-mesh/istio-cni-rhel9 OpenShift Service Mesh 3 Under investigation openshift-service-mesh/istio-pilot-rhel9 OpenShift Service Mesh 3 Under investigation openshift-service-mesh/istio-proxyv2-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation rhacm2/acm-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation rhacm2/kube-state-metrics-rhel9 Red Hat Ceph Storage 8 Fix deferred rhceph/rhceph-promtail-rhel9 Red Hat Enterprise Linux 10 Under investigation grafana Red Hat Enterprise Linux 10 Under investigation gvisor-tap-vsock Red Hat Enterprise Linux 8 Under investigation grafana Red Hat Enterprise Linux 9 Under investigation grafana Red Hat Enterprise Linux 9 Under investigation gvisor-tap-vsock Red Hat Hardened Images Not affected etcd Red Hat Hardened Images Not affected grafana12.4 Red Hat Hardened Images Not affected grafana13.1 Red Hat Hardened Images Not affected grafana13.2 Red Hat Hardened Images Not affected kubernetes1.35 Red Hat Hardened Images Not affected kubernetes1.36 Red Hat Hardened Images Not affected loki3.7 Red Hat Hardened Images Not affected tempo2.10 Red Hat Hardened Images Not affected tempo3.0 Red Hat OpenShift Container Platform 4 Under investigation microshift Red Hat OpenShift Container Platform 4 Under investigation openshift Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-cluster-baremetal-operator-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-cluster-capi-rhel9-operator Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-cluster-cloud-controller-manager-rhel9-operator Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-cluster-control-plane-machine-set-rhel9-operator Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-dpu-cni-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-dpu-daemon-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-dpu-intel-netsec-vsp-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-dpu-marvell-cp-agent-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-dpu-marvell-vsp-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-dpu-network-resources-injector-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-dpu-rhel9-operator Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-etcd-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-image-customization-controller-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-kube-state-metrics-rhel9 Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-cluster-baremetal-operator-rhel9 Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-cluster-capi-rhel9-operator Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-cluster-cloud-controller-manager-rhel9-operator Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-cluster-control-plane-machine-set-rhel9-operator Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-dpu-cni-rhel9 Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-dpu-daemon-rhel9 Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-dpu-intel-netsec-vsp-rhel9 Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-dpu-marvell-cp-agent-rhel9 Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-dpu-marvell-vsp-rhel9 Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-dpu-network-resources-injector-rhel9 Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-dpu-rhel9-operator Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-etcd-rhel9 Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-image-customization-controller-rhel9 Red Hat OpenShift Container Platform 5 Under investigation openshift5/ose-kube-state-metrics-rhel9 Red Hat Openshift Data Foundation 4 Not affected odf4/odf-multicluster-rhel9-operator Red Hat OpenShift GitOps Affected openshift-gitops-1/argocd-agent-rhel9 Red Hat OpenShift GitOps Affected openshift-gitops-1/argocd-image-updater-rhel9 Red Hat OpenShift GitOps Affected openshift-gitops-1/argocd-rhel9 Red Hat OpenShift GitOps Affected openshift-gitops-1/gitops-rhel9 Red Hat OpenShift GitOps Affected openshift-gitops-1/gitops-rhel9-operator Red Hat OpenStack Platform 18.0 Not affected rhoso-operators/openstack-operator-bundle https://www.cve.org/CVERecord?id=CVE-2026-77299 https://nvd.nist.gov/vuln/detail/CVE-2026-77299 https://github.com/dlclark/regexp2/commit/6e446cb3a57a0f20112bc24353604fd00bdb309a https://github.com/dlclark/regexp2/releases/tag/v2.3.0 https://github.com/dlclark/regexp2/security/advisories/GHSA-wq9v-j77v-qr26