EUVD-2026-35009
GHSA-8hjh-2xhj-mx62
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in kokke tiny-regex-c up to f2632c6d9ed25272987471cdb8b70395c2460bdb. This vulnerability affects the function matchstar of the file re.c of the component Pattern Handler. This manipulation causes inefficient regular expression complexity. The attack is restricted to local execution. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
ReDoS (Regular Expression Denial of Service) in kokke tiny-regex-c up to commit f2632c6d9ed25272987471cdb8b70395c2460bdb allows local low-privileged attackers to cause availability degradation by supplying crafted input to the matchstar function in re.c, triggering exponential backtracking in the pattern handler. A public proof-of-concept exploit (tiny-regex-c-redos-poc.zip) has been published, though no vendor patch exists and the project maintainer has not responded to the responsible disclosure. No active exploitation in the wild has been confirmed (not in CISA KEV), and real-world risk is constrained by the local-only attack vector and low availability impact.
Technical ContextAI
tiny-regex-c is a minimalist C library implementing basic regular expression matching without a formal finite automaton engine. The matchstar function in re.c handles the '*' (zero-or-more) quantifier using a backtracking approach: for each position in the input, it recursively or iteratively explores all possible match lengths. CWE-400 (Uncontrolled Resource Consumption) is the root cause - when a crafted pattern combined with a crafted input string causes the backtracker to explore an exponentially large number of candidate paths (classic catastrophic backtracking / ReDoS), CPU consumption grows unboundedly relative to input size. This class of vulnerability is well-understood in regex engines lacking linear-time guarantees (e.g., those not based on Thompson NFA or RE2). No CPE string was included in the provided data; the affected artifact is identified solely by repository URL and commit hash.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the vulnerability report filed at https://github.com/kokke/tiny-regex-c/issues/100. Dependent projects should monitor the upstream repository at https://github.com/kokke/tiny-regex-c/ for any remediation commit. As an immediate compensating control, developers should enforce strict length limits on both the regex pattern string and the input string before passing them to matchstar - this bounds worst-case backtracking depth at the cost of rejecting longer but legitimate inputs. A more durable mitigation is to replace tiny-regex-c entirely with a linear-time regex engine such as RE2 or PCRE2 (in DFA mode), which eliminates ReDoS by design; this requires API-level refactoring and testing. If replacement is not feasible, wrapping the call in a timeout or separate thread with CPU quota enforcement (e.g., via setrlimit on Linux) can prevent full process hang, though it adds complexity and may cause partial failures that need graceful handling.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today