Regex denial of service (ARCH4135)

Key java.security.regex-dos · Severity warning · Category security · CWE CWE-1333

Regexes with nested quantifiers (e.g. (a+)+) applied to untrusted input cause catastrophic backtracking; an attacker can exhaust CPU with a short input (ReDoS).

Incorrect

Pattern p = Pattern.compile("(a+)+$");
boolean match = p.matcher(userInput).matches();

Correct

Pattern p = Pattern.compile("a+$");
boolean match = p.matcher(userInput).matches();

Fix

Simplify the regex to remove nested quantifiers; bound input length or use a linear-time engine.