PT-2026-66605 · Re2 · Re2
CVE-2026-68499
·
Published
2026-07-30
·
Updated
2026-07-31
CVSS v3.1
6.2
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
re2 versions prior to 1.25.2
Description
The
String.prototype.match implementation fails to advance its native matching cursor in lib/match.cc when using a global RE2 pattern that can match an empty string. This behavior results in an infinite loop and unbounded native memory growth, which blocks the event loop and can lead to the exhaustion of host memory.Recommendations
Update to version 1.25.2.
Exploit
Fix
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Re2