{"id":"EM-20261106-ADH0","url":"https://cyber.eventmonitor.net/incident/EM-20261106-ADH0/regexp2-vulnerability-cve-2026-77299/","type":"cve","title":"Regexp2 Vulnerability (CVE-2026-77299)","subtitle":"CVE-2026-77299","subject":"CVE-2026-77299","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-06T02:17:52.893Z","firstSignal":"2026-11-06T01:28:58.000Z","lastSignal":"2026-11-06T02:17:52.893Z","updated":"2026-11-06T12:16:45.734Z","revision":1,"life":[{"status":"Born","at":"2026-11-06T02:17:52.893Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-06T02:17:52.893Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-06T01:28:58.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-06T02:17:52.893Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261106-ADH0 created."}],"stages":[{"name":"Disclosed","at":"2026-11-06T02:17:52.893Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-06T02:17:52.893Z","detail":"CVSS 7.5"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-06T01:28:58.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-06T01:28:58.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-77299 (important)","text":"github.com/dlclark/regexp2: regexp2: Denial of Service via unbounded memory allocation during pattern matching","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-77299.json"},{"at":"2026-11-06T02:17:52.893Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-77299 (CVSS 7.5)","text":"Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers onto the backtracking stack on every iteration. Because the parser accepts any repetition count up to math.MaxInt32 and the backtracking stack grows without bound, a pattern of fewer than 20 bytes matched against an empty input can force multi-gigabyte allocation and OOM-kill the process…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77299"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-06T02:17:52.893","score":7.5,"severity":"HIGH","desc":"Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers…","product":"","seen":1793946649095},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}