Denial of Service Vulnerability in Regexp2 Engine for Go

CVE-2026-77299

What is CVE-2026-77299?

The Regexp2 engine for Go, prior to version 2.3.0, is vulnerable to a Denial of Service (DoS) attack. When compiled patterns with large fixed-count quantifiers are executed against zero-width subexpressions, the match engine can enter a loop that indefinitely grows the backtracking stack. This behavior, triggered by certain regex patterns, can result in significant memory allocation, potentially overwhelming the system and causing it to become unresponsive. Remediation has been provided in version 2.3.0, which addresses this issue.

References