What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A regex warning is a lead, not proof that your application is vulnerable. To establish a ReDoS issue, reproduce the slowdown with the exact regex engine your code uses, a carefully chosen input, and a strict time limit. The redosray project documentation describes a local scanner that pairs static candidates with timed tests and proposes rewrites after its checks; those are project claims, not independently verified guarantees. Any suggested fix still needs to preserve the behavior your application relies on.
What counts as proof of a ReDoS bug?
ReDoS, or regular-expression denial of service, occurs when processing a particular input makes a regex take exceptionally long. As OWASP explains, a backtracking engine may explore many alternative ways to match a string. The work can grow super-linearly or exponentially for some patterns and inputs.
As an Amazon Associate I earn from qualifying purchases.
Patterns with nested repetition, such as (a+)+$, or overlapping alternatives, such as (a|aa)+, can be risky in backtracking engines. A crafted string that nearly matches but ultimately fails can force the engine to retry many possible partitions. These examples illustrate a risk pattern; they do not prove that every use of either expression is exploitable.
Recommended Free Tools
A static scanner can identify suspicious structure, but a warning alone is not a measured failure in your application. A useful reproduction demonstrates that the target engine takes excessive time on a specific input under the conditions in which your code uses the regex. The result depends on the engine, its version and supported syntax, and the surrounding application.
#1 Best Overall
How does the documented offline workflow work?
The redosray project page describes a two-stage workflow: identify static candidates, then run each candidate in an isolated worker against a purpose-built input that grows geometrically. The project says each finding includes the input that crosses its timeout and a growth curve, and that its command-line scanner handles JavaScript, TypeScript, and Python locally without uploading source. These are descriptions from the project, not independently confirmed test results. They do not establish that the scanner finds every vulnerable expression or that every slowdown it reports is exploitable in production.
The reported input, timing, and growth behavior can help make a candidate reproducible. A worker and timeout are sensible safeguards for testing a potentially expensive expression, but a bounded local run is not a substitute for understanding how the application invokes the regex or what resources are available there.
Rank #2
- Comes with secure packaging
- It can be a gift item
- Easy to read text
How to reproduce a finding safely
- Identify the exact pattern and engine. Record the regex as used by the application, including flags and relevant configuration. Confirm the language runtime and regex engine version; the same pattern can behave differently across engines.
- Isolate the test and set a hard bound. Use a disposable process or worker with a timeout and resource limits. Do not run a potentially pathological case in a production request path or an unbounded test job.
- Start with the reported failing input. Preserve the input that triggers the timeout or marked slowdown. Check that it reaches the regex under test and is not rejected or transformed earlier by application code.
- Measure as input grows. Compare runtimes for progressively longer inputs, including the failing or near-matching case. A steep growth pattern supports a ReDoS diagnosis; a single slow measurement may instead reflect noise, startup cost, or other work in the test harness.
- Minimize the reproducer. Reduce the pattern or input while retaining the slowdown. A small, repeatable case is easier to review and to keep as a regression test.
GitHub Security Lab recommends reproducing a suspected issue with a proof of concept before changing the regex. Its guidance also describes reduction and fuzzing as ways to find and understand problematic cases. See “What is ReDoS, and how do you fix it?”.
What must a fix verify?
A fast rewrite is not automatically a correct rewrite. A repair needs to reduce the problematic runtime while retaining the intended matching behavior for valid, invalid, and boundary inputs. If callers depend on capture groups, match boundaries, or other regex results, those are part of the behavior to preserve.
Rank #3
- Keep the minimized slow input as a performance regression case.
- Run functional tests for expected matches and nonmatches, including relevant edge cases.
- Compare capture groups and other outputs that application code consumes.
- Repeat the bounded timing check using the application’s actual engine and runtime version.
The redosray project says it offers a suggested rewrite only after dynamic non-hang confirmation and differential testing. That describes the project’s stated check; it is not a guarantee that a rewrite is equivalent for every application input or use of capture groups. Review the change in context and validate it against the application’s own tests.
Why engine and language matter
ReDoS risk is not determined by the regex text alone. It depends on the engine, version, supported constructs, and how the expression is used. Kevin Backhouse of GitHub Security Lab defines it this way: “A ReDoS is a denial-of-service (DOS) vulnerability in which a regex runs exceptionally slowly on some inputs.”
Backhouse notes that many languages use backtracking implementations and discusses CodeQL ReDoS queries for JavaScript, Python, Java, C#, and Ruby. The same article identifies Go, Rust, and RE2 as not vulnerable in the context it discusses. Do not generalize that statement to every regex API or system configuration: verify the specific engine that runs your pattern.
How should you evaluate a scanner?
Before relying on a tool, check whether its evidence and workflow fit your codebase. A language listed as supported does not by itself establish support for every syntax feature or engine version.
- Language, syntax, and engine: Which languages and regex constructs does it parse, and does it test the engine your application actually uses?
- Evidence type: Does it only flag suspicious patterns, or does it attempt a bounded dynamic reproduction?
- Reproduction details: Does a finding include an attack input, timing information, and a growth curve?
- Safety and data handling: How are workers isolated and timeouts enforced? Does source stay on your machine?
- Fix validation: Does the tool test a suggested rewrite for hangs and compare behavior, and what behavior is included in that comparison?
- Workflow and terms: Can it run in CI or a pre-commit check, and do its license and commercial-use terms suit your project?
Other documented approaches include CodeQL’s ReDoS queries and ReDoctor, a Python scanner whose repository describes static analysis combined with fuzzing. The ReDoctor repository states that commercial production use requires a paid license under its BSL-1.1 terms and gives a planned MIT conversion date; check its current documentation for the applicable terms. Tool support and licensing can change, so verify current project documentation before adopting a scanner.
What published evaluation results do—and do not—show
The ReDoSHunter authors reported 100% precision and 100% recall on three large-scale datasets containing 37,651 regexes in their 2021 USENIX Security paper. They also reported 28 new ReDoS vulnerabilities across 26 projects, 26 assigned CVEs, and two fixes. Those are results reported for that paper’s datasets and evaluation, not a benchmark of redosray or a guarantee of performance on another codebase. The paper frames combined static and dynamic detection as a research direction; it does not establish that any scanner catches every real-world issue.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
