CWE-1333 — Inefficient Regular Expression Complexity
CWE-1333: Inefficient Regular Expression Complexity
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | High |
Description
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Common consequences
- Availability: DoS: Resource Consumption (CPU)
Mitigations
Architecture and Design — Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration — Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation — Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Implementation — Limit the length of the input that the regular expression will process.
References
- CWE page: https://cwe.mitre.org/data/definitions/1333.html
- CWE list: https://cwe.mitre.org/data/index.html