Reggie Version
0.3.0
Java Version
26.0.2
Compilation Mode
Runtime (Reggie.compile())
Regex Pattern
(\1)
Description
The pattern “(\1)”, which does not make much sense, seems to expose a vulnerability.
The following fragment demonstrates the issues:
// Using JDK 26.0.2 and Reggie 0.3.0
ReggieMatcher matcher = Reggie.compile( "(\\1)");
List<MatchResult> matches = matcher.findAll("a");
System.out.println(matches.size());Execution hangs and eventually ends with an OutOfMemoryError. The CPU and memory usage becomes abnormal like in the case of ReDoS.
Other engines, which support backreferences, either return no results (like java.util.regex and PCRE2), or one or two empty results. Reggie should have a similar behaviour.
The problem could have connections with #39 and #48.
Additional Context
No response
Reggie Version
0.3.0
Java Version
26.0.2
Compilation Mode
Runtime (Reggie.compile())
Regex Pattern
(\1)
Description
The pattern “(\1)”, which does not make much sense, seems to expose a vulnerability.
The following fragment demonstrates the issues:
Execution hangs and eventually ends with an OutOfMemoryError. The CPU and memory usage becomes abnormal like in the case of ReDoS.
Other engines, which support backreferences, either return no results (like java.util.regex and PCRE2), or one or two empty results. Reggie should have a similar behaviour.
The problem could have connections with #39 and #48.
Additional Context
No response