Skip to content
NewA calmer, faster ZeroHour
Researchinfo

An Empirical Analysis of ReDoS Vulnerabilities and ReDoS Detection Tools

arXiv cs.CRby N'Zolieh Ismaël Mahassadi ()1 min read2 · 2 reads
Read at arxiv.org
AI summary · glm-5.3-flashSummaries by Vani AI

Study of NVD data finds ReDoS vulnerabilities growing more prevalent and more likely to be exploited, while five detection tools disagree substantially.

The study compares five publicly available ReDoS detection tools and one regex correction tool across three datasets. An empirical analysis of all ReDoS vulnerabilities reported to the NVD finds they are becoming more prevalent and are much more likely to be exploited than non-ReDoS weaknesses. The detection tools exhibited substantial disagreement on whether a given regex is vulnerable.

Key facts
  • Five ReDoS detection tools show substantial disagreement on vulnerable regexes
  • ReDoS vulnerabilities are increasingly prevalent in the NVD
  • ReDoS weaknesses are much more likely to be exploited than non-ReDoS ones
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
denial-of-servicenvdredosregexstatic-analysisvulnerability-analysis
Organizations
National Vulnerability Database

From the original article

1 min read at arxiv.org

ReDoS vulnerabilities are a type of denial of service software weakness that occurs when a regex is used to validate user-supplied input. In some cases, the regex matching process can take exponential time, leading to a denial of service. In this study, we examine and compare the effectiveness of five publicly-available regex detection tools, and one regex correction tool, using three datasets.

arXiv cs.CR

By N'Zolieh Ismaël Mahassadi · arxiv.org

Read the full article at arXiv cs.CR

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.