Regular expression denial of service is a performance attack that exploits inefficient regex execution. An attacker sends crafted input that forces excessive backtracking, consuming CPU and slowing or blocking service.
Expanded Definition
ReDoS, or regular expression denial of service, is a performance abuse condition rather than a data-exfiltration technique. It occurs when a regex engine evaluates a pattern in a way that creates excessive backtracking, causing a disproportionate CPU load and delayed responses. The risk is highest when a service accepts attacker-controlled input, applies a vulnerable pattern, and does so in a latency-sensitive path such as authentication, API filtering, or log processing. In security operations, ReDoS is usually treated as an availability issue, but it can also become an operational control failure when it prevents security checks from completing. Guidance varies across languages and regex engines, because some implementations are more resistant than others and no single standard governs safe regex construction. NHI Management Group treats ReDoS as a design and assurance concern, not just a coding defect. For a broader governance lens, the NIST Cybersecurity Framework 2.0 is useful for mapping resilience and service continuity obligations. The most common misapplication is assuming any slow regex is benign, which occurs when teams test only normal inputs and never adversarial payloads.
Examples and Use Cases
Implementing regex-heavy controls rigorously often introduces performance tuning and pattern review overhead, requiring organisations to weigh detection accuracy against service responsiveness.
- A login service uses a vulnerable email-validation pattern, and a crafted string drives repeated backtracking until the endpoint times out.
- An API gateway applies a complex input filter before routing requests, and an attacker sends a sequence that consumes threads or worker CPU.
- A SIEM parsing pipeline runs regex extraction on untrusted logs, and a malformed record stalls ingestion long enough to delay alerting.
- A content moderation or DLP rule set relies on nested quantifiers, and a single malicious payload causes the inspection service to degrade under load.
- A developer adds a pattern intended to validate identifiers, then discovers that an edge-case input creates a near-lockup in the runtime engine.
Teams commonly reduce exposure by simplifying patterns, limiting input length, using safer regex features, or replacing regex with deterministic parsing where possible. The OWASP Top 10 is not a regex standard, but it reinforces the broader lesson that unsafe input handling often turns into application-layer failure. Where operational continuity matters, the question is not whether a pattern works in testing, but whether it remains stable under hostile input and production traffic patterns.
Why It Matters for Security Teams
ReDoS matters because it converts a single crafted request into a disproportionate resource drain, which can create cascading failures across shared services, queues, and security controls. For defenders, the issue is not only application uptime; it is also assurance that validation, routing, detection, and identity-adjacent checks continue to function when inputs are hostile. This is especially relevant where regex is used to screen usernames, tokens, headers, or other identity-related fields, because a stalled validator can become an access bottleneck or an availability blind spot. Security teams should treat risky regex patterns as part of secure development, code review, and resilience testing rather than as an isolated engineering nuisance. The MITRE CWE catalogue is commonly used to classify weakness patterns, while OWASP guidance helps situate input-driven failure modes within application security programs. Organisations typically encounter the operational impact only after a production slowdown or outage, at which point ReDoS becomes unavoidable to diagnose and remediate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.IP-1 | Secure development practices reduce regex patterns that can trigger availability failures. |
| NIST AI RMF | AI systems that rely on regex-based preprocessing can inherit availability risk from ReDoS. | |
| OWASP Agentic AI Top 10 | Agentic apps often use regex in tool routing and input checks that attackers can overload. | |
| OWASP Non-Human Identity Top 10 | NHI workflows often validate tokens and identifiers with regex, creating DoS exposure. |
Assess regex-dependent preprocessing in AI pipelines for resilience under adversarial input.
