CVE-2026-77299

Overview

CVE-2026-77299 is a high-severity denial-of-service vulnerability in the Regexp2 Go library, affecting versions prior to 2.3.0. The flaw allows an attacker to trigger excessive memory allocation and process termination by supplying a specific regular expression pattern with a large fixed-count quantifier applied to a zero-width subexpression. This issue is critical for any Go application that compiles user-supplied regular expressions using this library.

Description

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers onto the backtracking stack on every iteration. Because the parser accepts any repetition count up to math.MaxInt32 and the backtracking stack grows without bound, a pattern of fewer than 20 bytes matched against an empty input can force multi-gigabyte allocation and OOM-kill the process. MatchTimeout does not fully mitigate this because the memory is allocated faster than the 100 ms timeout clock can fire. This issue has been patched in version 2.3.0.

Impact

Confidentiality and Integrity are not directly impacted, but Availability is severely compromised. Attackers can cause an Out-Of-Memory (OOM) kill of the application process, leading to service disruption. The vulnerability is particularly dangerous because the memory allocation occurs faster than the standard MatchTimeout mechanism can intervene, rendering default timeouts ineffective. Any service relying on Regexp2 for pattern matching is at risk of being taken offline by a minimal input payload.

Remediation

Upgrade the Regexp2 library to version 2.3.0 or later immediately. If an immediate upgrade is not possible, implement strict input validation to reject regular expression patterns containing large fixed-count quantifiers (e.g., {50000000}) or zero-width subexpressions with high repetition counts. Consider implementing external resource limits (such as cgroups or container memory limits) to contain the impact of OOM events, though this does not prevent the DoS condition itself.

Risk context

The CVSS v3 score of 7.5 indicates a high severity risk, primarily due to the ease of exploitation and the guaranteed denial-of-service impact. While no EPSS score is currently available, the deterministic nature of the memory exhaustion and the bypass of standard timeout mitigations suggest a high likelihood of exploitation in environments where user-controlled regex patterns are processed. Defenders should prioritize patching to prevent potential service outages.

Affected products

• Regexp2 < 2.3.0