ReDoS
A class of security vulnerability in which an attacker crafts malicious input that drives a regular expression engine into exponential backtracking, exhausting CPU resources and rendering a service unavailable.
Timeline (last 90 days)
ReDoS (regular expression denial of service) is the third type of bug planted in the code review test; its principle is that certain regular expressions, when matching specific forms of malicious input, have a number of backtracks that grows exponentially, causing the CPU to be occupied for a long time.
This LangChain release introduced a security patch targeting the soupsieve ReDoS vulnerability.
ReDoS (Regular Expression Denial of Service) attacks stem from certain regular expressions triggering exponential or polynomial complexity growth in backtracking algorithms when processing specially crafted inputs, causing CPU resources to be exhausted.
All Facts (4)
Perl、Python、Java、JavaScript、Ruby等主流语言的内置正则引擎几乎都采用带回溯的NFA实现，理论上都存在ReDoS风险
90%UnverifiedReDoS (regular expression denial of service) is the third type of bug planted in the code review test; its principle is that certain regular expressions, when matching specific forms of malicious input, have a number of backtracks that grows exponentially, causing the CPU to be occupied for a long time.
50%UnverifiedReDoS (Regular Expression Denial of Service) attacks stem from certain regular expressions triggering exponential or polynomial complexity growth in backtracking algorithms when processing specially crafted inputs, causing CPU resources to be exhausted.
50%UnverifiedThis LangChain release introduced a security patch targeting the soupsieve ReDoS vulnerability.
50%