CWE-1333

Inefficient Regular Expression Complexity

High

Description

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Potential Impact

How to Fix

Architecture and Design

Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

System Configuration

Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Implementation

Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

Implementation

Limit the length of the input that the regular expression will process.

Detection Methods

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-1333 vulnerabilities in your codebase.

Get Security Assessment