---
id: CVE-2026-77299
title: >-
  Regexp2: Unbounded memory amplification via large `{m}` quantifier on a
  zero-width subexpression
summary: >-
  Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when
  regexp2 compiles and matches a pattern containing a large fixed-count
  quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the
  match engine …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-770
vendor: dlclark
product: regexp2
affected:
  - regexp2 < 2.3.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T17:43:22.051755Z'
exploitAvailable: true
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:43:52.421Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-77299'
references:
  - url: 'https://github.com/dlclark/regexp2/security/advisories/GHSA-wq9v-j77v-qr26'
    label: 'https://github.com/dlclark/regexp2/security/advisories/GHSA-wq9v-j77v-qr26'
  - url: >-
      https://github.com/dlclark/regexp2/commit/6e446cb3a57a0f20112bc24353604fd00bdb309a
    label: >-
      https://github.com/dlclark/regexp2/commit/6e446cb3a57a0f20112bc24353604fd00bdb309a
  - url: 'https://github.com/dlclark/regexp2/releases/tag/v2.3.0'
    label: 'https://github.com/dlclark/regexp2/releases/tag/v2.3.0'
tags:
  - cve.org
  - exploit-available
epss: 0.00346
epssPercentile: 0.28342
ingestedAt: '2026-11-06T01:43:15.111Z'
---

## Overview

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers onto the backtracking stack on every iteration. Because the parser accepts any repetition count up to math.MaxInt32 and the backtracking stack grows without bound, a pattern of fewer than 20 bytes matched against an empty input can force multi-gigabyte allocation and OOM-kill the process. MatchTimeout does not fully mitigate this because the memory is allocated faster than the 100 ms timeout clock can fire. This issue has been patched in version 2.3.0.

## Affected

- `regexp2 < 2.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.