CVE-2026-77299

Name of the Vulnerable Software and Affected Versions Regexp2 versions prior to 2.3.0

Description When the engine compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression, the match engine executes an empty loop body multiple times, pushing two integers onto the backtracking stack during each iteration. Since the parser allows repetition counts up to math.MaxInt32 and the backtracking stack grows without bound, a small pattern matched against an empty input can trigger multi-gigabyte memory allocation, leading to an Out-of-Memory (OOM) kill of the process. The MatchTimeout feature does not fully mitigate this because memory allocation occurs faster than the timeout clock can trigger.

Recommendations Update to version 2.3.0.