regexp2 Go regex library exhausts memory via large repeat count
Programs using this Go pattern library can be crashed by short input.
Summary
The regexp2 regular-expression library for Go lets a short pattern force huge memory allocation, which can make the process run out of memory and be killed. Programs that compile patterns from untrusted input are affected.
Affected when
- Program compiles regex patterns from untrusted input
- regexp2 versions before 2.3.0
What to do
Update regexp2 to 2.3.0 or later. Programs that include this library must be updated.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
Times
First published
First seen