# Regexploit: DoS-able Regular Expressions

Regexploit tool finds ReDoS in regexes like ua-parser and cpython cookiejar, where crafted input causes cubic backtracking and CPU exhaustion.

- Payout: Research
- Severity: medium
- Program: Regexploit
- Credited: Doyensec
- Disclosed: 2021-03-10
- Write-up quality: 7/10
- Original: https://blog.doyensec.com/2021/03/11/regexploit.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2021-03-11-regexploit-html
- Tags: domain:oss impact:dos kind:research platform:research sev:medium tech:nodejs tech:python tech:ruby technique:fuzzing technique:source-review vuln:dos

**Target:** Regular expression engines in Python, JS, Ruby, C# libraries
**Root cause:** Ambiguous regexes with overlapping repeating groups (e.g. \d+[^);]+[^);]*) allow many ways to split input, causing cubic backtracking when input fails to match.
**Steps:**
1. Identify regex with overlapping repeating character classes
2. Craft input that reaches the ambiguous section but fails final match (e.g. omit closing paren)
3. Send payload like `;0 Build/HuaweiA` + `0`*3456 as User-Agent
4. Regex engine backtracks exponentially/cubically, blocking event loop
**How found:** Author built Regexploit to walk regex ASTs finding ambiguities where one character matches multiple repeating parts, then searched for non-matching suffixes to force backtracking; scanned top npm/pypi libraries.
**Exploitation:** Attacker sends a single crafted HTTP header (User-Agent or Set-Cookie Expires) to a server using a vulnerable regex; the regex engine backtracks for years, blocking NodeJS event loop or Python thread, causing DoS.
**Insight:** Look for regexes parsing structured languages (Markdown, CSS, SVG, dates) with optional whitespace groups like `\s*(.+?)\s*` — the inner wildcard also matches whitespace, creating cubic backtracking on non-matching input.