Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-77299— Regexp2: Unbounded memory amplification via large `{m}` quantifier on a zero-width subexpression

Quick assessment

Affected
dlclark regexp2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Regexp2 是一个功能丰富的 Go 语言正则表达式引擎。在 2.3.0 版本之前，当 regexp2 编译并匹配包含“应用于零宽子表达式的大固定重复量词”的模式（例如 ）时，匹配引擎会执行空循环体 m-1 次，并在每次迭代中将两个整数压入回溯栈。由于解析器接受高达 math.MaxInt32 的任意重复次数，且回溯栈会无限制增长，因此即使是一个不足 20 字节的模式在匹配空输入时，也可能触发数 GB 的内存分配，导致进程因内存不足（OOM）而被终止。MatchTimeout 无法完全缓解此问题，因为内存分配速度

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77299

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Regexp2: Unbounded memory amplification via large `{m}` quantifier on a zero-width subexpression
Source: CVE Program / CVE List V5
Vulnerability Description
Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers onto the backtracking stack on every iteration. Because the parser accepts any repetition count up to math.MaxInt32 and the backtracking stack grows without bound, a pattern of fewer than 20 bytes matched against an empty input can force multi-gigabyte allocation and OOM-kill the process. MatchTimeout does not fully mitigate this because the memory is allocated faster than the 100 ms timeout clock can fire. This issue has been patched in version 2.3.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
dlclark regexp2 < 2.3.0 -

II. Public POCs for CVE-2026-77299

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77299

请登录查看更多情报信息。

Other References for CVE-2026-77299 (3)

IV. Related Vulnerabilities

Same weakness: CWE-400