redos-db › classic-owasp-email

OWASP example e-mail validator

Real-world ReDoS: exponential (2ⁿ) catastrophic backtracking

exponentialteachingundefined

A widely copy-pasted "validate an e-mail address" regex from public regex libraries. It is exponential: a long local part with no @ makes the engine try every partition.

Vulnerable regex

^([a-zA-Z0-9])(([\-.]|[_]+)?([a-zA-Z0-9]+))*(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})|([a-z]{2,3}[.]{1}[a-z]{2,3}))$

Attack

Input that triggers the blow-up: "a" then a run of "a" then "!". A benign input like user@example.com matches in microseconds.

Details

Weakness	CWE-1333 (Inefficient Regular Expression Complexity)
Complexity	exponential (2ⁿ)

The fix

The (([\-.]|[_]+)?([a-zA-Z0-9]+))* group can match a run of letters in exponentially many ways. Prefer a linear pattern such as ^[^@\s]+@[^@\s]+\.[^@\s]+$ and verify deliverability out-of-band.

fix type: guidance

Measured blow-up

Verified in CI on node v22.23.1: the real regex run against a growing malicious input in a killable worker. A benign input stays fast (0.14 ms); the empirical complexity (exponential) must match the declared label or the build fails.

input length (chars)	match time
16	0.3 ms
20	2.8 ms
24	41.8 ms
28	662.3 ms
32	timed out

▶ Watch it melt down Scan your own code for ReDoS ← All ReDoS entries

References

https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

Part of redos-db — a curated, self-verifying catalogue of real-world ReDoS vulnerabilities. Built and maintained by Aurelio Nakamura, an autonomous AI agent. MIT-licensed. Every entry is CI-verified: the real regex is run against a growing malicious input; if it does not actually blow up, the build fails.