{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:02:21Z","timestamp":1782975741231,"version":"3.54.5"},"reference-count":81,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"publisher","award":["FT - 250100652"],"award-info":[{"award-number":["FT - 250100652"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00169","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"3984-4002","source":"Crossref","is-referenced-by-count":0,"title":["PufferDoS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities"],"prefix":"10.1109","author":[{"given":"Shangzhi","family":"Xu","sequence":"first","affiliation":[{"name":"The University of New South Wales"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ziqi","family":"Ding","sequence":"additional","affiliation":[{"name":"The University of New South Wales"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiao","family":"Cheng","sequence":"additional","affiliation":[{"name":"Macquarie University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuekang","family":"Li","sequence":"additional","affiliation":[{"name":"The University of New South Wales"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nan","family":"Sun","sequence":"additional","affiliation":[{"name":"The University of New South Wales"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Benjamin","family":"Turnbull","sequence":"additional","affiliation":[{"name":"The University of New South Wales"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shuangxiang","family":"Kan","sequence":"additional","affiliation":[{"name":"The University of New South Wales"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Siqi","family":"Ma","sequence":"additional","affiliation":[{"name":"The University of Wollongong,CSIRO"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Rengar: Regular expression denial-of-service analyzer"},{"key":"ref2","article-title":"PufferDoS: Anonymous artifact repository"},{"key":"ref3","year":"2018","journal-title":"CVE-2017\u201316098: Apache Charset Regular Expression Denial of Service (ReDoS)"},{"key":"ref4","year":"2017","journal-title":"CVE-2017\u201316137: Regular Expression Denial of Service in debug module (\u00f6formatter)"},{"key":"ref5","year":"2023","journal-title":"CVE-2023\u201339663: MathJax Regular Expression Denial of Service (ReDoS)"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-54580-5_12"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-3_28"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/s10515-013-0132-0"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-99524-9_24"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510047"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2016.2515587"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3708821.3733912"},{"key":"ref13","article-title":"An additional non-backtracking regexp engine \u2022 v8","author":"Bidlingmaier","year":"2021"},{"key":"ref14","first-page":"209","article-title":"Klee: unassisted and automatic generation of high-coverage tests for complex systems programs.","volume":"8","author":"Cadar","year":"2008","journal-title":"OSDI"},{"key":"ref15","article-title":"regexploit: Find regular expressions which are vulnerable to redos","volume-title":"License: Apache-2.0","volume":"v1.0.0","author":"Caller","year":"2021"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/2931037.2931073"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3342509"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3236024.3236027"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-3_24"},{"key":"ref20","first-page":"693","article-title":"Detecting asymmetric application-layer {Denial-ofService} attacks {In-Flight} with{FineLame}","volume-title":"2019 USENIX Annual Technical Conference (USENIX ATC 19)","author":"Demoulin","year":"2019"},{"key":"ref21","article-title":"regexploit: Regular expression security tooling","volume-title":"doyensec","year":"2025"},{"key":"ref22","article-title":"Mastering regular expressions","author":"Friedl","year":"2006","journal-title":"O\u2019Reilly Media, Inc."},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/1190216.1190226"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/1065010.1065036"},{"key":"ref25","article-title":"pytype: A static type analyzer for python","volume-title":"Google","year":"2025"},{"key":"ref26","article-title":"RE2: Linear-time regular expression engine","year":"2025","journal-title":"Google"},{"key":"ref27","author":"Graham-Cumming","journal-title":"Details of the cloudflare outage on july 2, 2019"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3814959"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/568438.568455"},{"key":"ref30","first-page":"8367","article-title":"Towards automatic detection and exploitation of java web application vulnerabilities via concolic execution guided by crossthread object manipulation","volume-title":"34th USENIX Security Symposium (USENIX Security 25)","author":"Huang","year":"2025"},{"key":"ref31","article-title":"Outage postmortem - july 20, 2016","journal-title":"S. E. Inc."},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2019.00059"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3643740"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338934"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-38631-2_11"},{"key":"ref36","article-title":"Oniguruma: Regular expression library","volume-title":"kkos","year":"2025"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1515\/9781400882618-002"},{"key":"ref38","first-page":"3847","article-title":"{ReDoSHunter}: A combined static and dynamic approach for regular expression {DoS} detection","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Li","year":"2021"},{"key":"ref39","first-page":"4183","article-title":"{RegexScalpel}: Regular expression denial of service ({{{{{ReDoS}}}}}) defense by {Localize-and-Fix}","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Li","year":"2022"},{"key":"ref40","first-page":"5591","article-title":"{CO3}: Concolic co-execution for firmware","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Liu","year":"2024"},{"key":"ref41","article-title":"A unified framework for compressed and encrypted text direct processing","author":"Liu","year":"2026","journal-title":"ICDE"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00062"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833613"},{"key":"ref44","article-title":"Python regex module on pypi","author":"Barnett"},{"key":"ref45","article-title":"Redos vulnerability reports: Relevant or noisy nuisance","author":"McInerney"},{"key":"ref46","first-page":"4219","article-title":"Regulator: Dynamic analysis to detect {ReDoS}","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"McLaughlin","year":"2022"},{"key":"ref47","article-title":"Common vulnerabilities and exposures (cve)","volume-title":"MITRE","year":"2025"},{"key":"ref48","volume-title":"Usability Engineering","author":"Nielsen","year":"1994"},{"key":"ref49","article-title":"Node.js official website","volume-title":"Node.js Foundation"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3213846.3213868"},{"key":"ref51","article-title":"Openjdk regular expression engine commit","volume-title":"OpenJDK Project"},{"key":"ref52","article-title":"java.util.regex package documentation","volume-title":"Oracle Corporation"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1016\/j.scico.2023.102960"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134073"},{"key":"ref55","article-title":"\u201cre-regular expression operations python 3 library reference","volume-title":"Python Software Foundation"},{"key":"ref56","article-title":"Static analysis for regular expression exponential runtime via substructural logics","volume":"abs\/1405.7058","author":"Rathnayake","year":"2014","journal-title":"CoRR"},{"key":"ref57","first-page":"1646","article-title":"Pycg: Practical call graph generation in python. in 2021 ieee\/acm 43rd international conference on software engineering (icse)","volume-title":"IEEE, IEEE, Madrid, Spain","author":"Salis","year":"2021"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/2426890.2426900"},{"key":"ref59","article-title":"Crosshair: A symbolic execution framework for python","author":"Schanely","year":"2025"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-34188-5_15"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238159"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3643916.3644424"},{"key":"ref63","article-title":"The state of open-source security","volume-title":"Snyk","year":"2020"},{"key":"ref64","first-page":"35","article-title":"A regular-expression matcher","author":"Spencer","year":"1994","journal-title":"Software solutions in C"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/3453483.3454066"},{"key":"ref66","first-page":"271288","article-title":"Towards an effective method of {ReDoS} detection for non-backtracking engines","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Su","year":"2024"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/363347.363387"},{"key":"ref68","first-page":"4165","article-title":"Counting in regexes considered harmful: Exposing {ReDoS} vulnerability of nonbacktracking matchers","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Turo\u0148ov\u00e1","year":"2022"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-032-07106-4_9"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2019.2953709"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/1723112.1723149"},{"key":"ref72","first-page":"309","article-title":"{NLP-EYE}: Detecting memory corruptions via {Semantic-Aware} memory operation function identification","volume-title":"22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019)","author":"Wang","year":"2019"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3757914"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179328"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00116"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40946-7_27"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-54580-5_1"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238223"},{"key":"ref79","first-page":"745761","article-title":"{QSYM}: A practical concolic execution engine tailored for hybrid fuzzing","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Yun","year":"2018"},{"key":"ref80","article-title":"Z3: The theorem prover","year":"2025","journal-title":"Z3Prover"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1007\/s00778-020-00636-3"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573367.pdf?arnumber=11573367","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:34:56Z","timestamp":1782970496000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573367\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":81,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00169","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}