# WEBrick::HTTPAuth::DigestAuth authentication is vulnerable to regular expression denial of service (ReDoS)

WEBrick DigestAuth's split_param_value regex backtracks catastrophically on crafted Authorization headers, letting one request pin CPU for seconds and DoS the server.

- Payout: hidden
- Severity: low
- Program: Ruby
- Found by: 358
- Disclosed: 2019-11-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/661722
- Library page: https://bugbountylibrary.com/r/h1%3A661722
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby technique:source-review vuln:dos

**Target:** WEBrick::HTTPAuth::DigestAuth split_param_value regex
**Root cause:** Regex `^\s*([\w\-\.\*\%\!]+)=\s*\"((\\.|[^\"])*)\"\s*,?` has nested quantifiers over alternation, causing catastrophic backtracking on unterminated quoted values.
**Steps:**
1. Run a WEBrick server with DigestAuth configured (as in the sample script).
2. Send `curl -I --header 'Authorization: Digest a="\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b' http://localhost:8000`.
3. Observe ~9s CPU-bound delay before 400 Bad Request; longer strings scale worse.
**How found:** Code review of the digest auth parser regex, spotting nested quantifiers `(\\.|[^\"])*` inside a quoted-string group and testing an unterminated quote with repeated escape-like chars.
**Exploitation:** Attacker sends repeated Authorization headers with long `\b` sequences inside an unterminated quoted value, each request consuming CPU for seconds, exhausting server capacity.
**Insight:** Digest auth quoted-string parsers using `(\\.|[^\"])*` are classic ReDoS: fuzz Authorization headers with unterminated quotes plus repeated backslash sequences to trigger exponential backtracking.