Yoff

The mechanize library, used for automatically interacting with HTTP web servers, contains a regular expression vulnerable to regular expression denial of service (ReDoS). If a web server responds maliciously, mechanize could crash.

Zulip is an open source team chat server that allows organization administrators to configure linkifiers, which automatically create links from messages sent by users, detected via arbitrary regular expressions. Malicious organization administrators could subject the server to a denial-of-service via regular expression complexity attacks by configuring a quadratic-time regular expression in a linkifier and sending messages that exploited it. The regular expression attempted to parse user-provided regexes to verify they were safe from ReDoS, but this was insufficient and itself subject to ReDoS if the organization administrator entered a sufficiently complex invalid regex.

The issue is related to a regular Expression Denial of Service in the sqlparse module for Python. The regular expression may cause exponential backtracking on strings containing many repetitions of `r ` in SQL comments. This affects the formatting feature that removes comments from SQL statements.