CVE-2026-11478
Description
A ReDoS vulnerability in tiny-regex-c's matchstar function allows local attackers to cause a CPU denial-of-service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A ReDoS vulnerability in tiny-regex-c's `matchstar` function allows local attackers to cause a CPU denial-of-service.
Vulnerability
A flaw exists in the matchstar and matchplus functions within re.c of the tiny-regex-c library up to commit f2632c6d9ed25272987471cdb8b70395c2460bdb. This vulnerability arises from inefficient regular expression complexity, specifically with chained greedy quantifiers like a*a*a*.... When a match fails after these quantifiers have consumed significant input, the engine enters a state of excessive backtracking, leading to a CPU denial-of-service. The project uses a rolling release strategy, so specific version numbers are not available [1].
Exploitation
An attacker can exploit this vulnerability by controlling either the regular expression pattern used by an application or by providing input that triggers a vulnerable pattern already present in the host application. The exploit requires local execution. The vulnerability is triggered when a pattern with multiple chained greedy quantifiers is matched against input that causes the overall match to fail near the end, forcing extensive backtracking [1].
Impact
Successful exploitation of this vulnerability results in a denial-of-service (DoS) condition. The affected application will consume excessive CPU resources due to the inefficient regular expression complexity, potentially becoming unresponsive. The attack is restricted to local execution [1].
Mitigation
As of the available references, no specific patch or fixed version has been released, and the project has not yet responded to the issue report [1]. The project adopts a rolling release strategy, making specific version details for affected or updated releases unavailable. There are no disclosed workarounds at this time [1].
AI Insight generated on Jun 8, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Range: up to f2632c6d9ed25272987471cdb8b70395c2460bdb
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The `matchstar` and `matchplus` functions in `re.c` implement greedy quantifiers with excessive backtracking, leading to inefficient regular expression complexity."
Attack vector
An attacker can trigger this vulnerability by providing a crafted regular expression pattern and input text that forces the regex engine into a state of catastrophic backtracking. This occurs when multiple greedy quantifiers are chained, and the overall match fails near the end of the input. The engine then repeatedly redistributes the input across quantifiers, exploring a rapidly growing number of failing paths, which consumes excessive CPU resources. This can be exploited in applications where an attacker can control the regex pattern or the input text that reaches a vulnerable pattern [ref_id=1].
Affected code
The vulnerability resides in the `matchstar` and `matchplus` functions within the `re.c` file of the tiny-regex-c library. These functions handle greedy quantifier matching, specifically the `*` and `+` operators. The issue arises from their backtracking mechanism when dealing with chained greedy quantifiers, as demonstrated in the provided proof-of-concept pattern `a*a*a*a*a*a*a*a*a*a*a*a*a*a*b` [ref_id=1].
What the fix does
The advisory does not specify a patch or remediation steps beyond general recommendations. It suggests replacing the current backtracking quantifier implementation with a linear-time matching strategy, adding a match-step budget or timeout, rejecting ambiguous repeated quantifier chains, and returning a compile-time error for patterns that would be truncated. For host applications, it recommends avoiding untrusted regex patterns or enforcing limits and timeouts if user-controlled regex is necessary [ref_id=1].
Preconditions
- inputAttacker controls the regular expression pattern or the input text that triggers the vulnerable pattern.
Reproduction
Step 1: Build the verification program using the provided files. Step 2: Run the matcher with increasing failed-match input lengths, for example: `. edos.exe aaaaaaaaaaaa`, `. edos.exe aaaaaaaaaaaaaaa`, `. edos.exe aaaaaaaaaaaaaaaaaa`. Step 3: Observe that all inputs fail to match, but CPU time grows rapidly with increasing input length [ref_id=1].
Generated on Jun 8, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5News mentions
0No linked articles in our index yet.