{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,13]],"date-time":"2026-10-13T16:56:00Z","timestamp":1791910560459,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":40,"publisher":"ACM","license":[{"start":{"date-parts":[[2018,10,26]],"date-time":"2018-10-26T00:00:00Z","timestamp":1540512000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CNS-1814430"],"award-info":[{"award-number":["CNS-1814430"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2018,10,26]]},"DOI":"10.1145\/3236024.3236027","type":"proceedings-article","created":{"date-parts":[[2018,10,29]],"date-time":"2018-10-29T08:06:00Z","timestamp":1540800360000},"page":"246-256","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":81,"title":["The impact of regular expression denial of service (ReDoS) in practice: an empirical study at the ecosystem scale"],"prefix":"10.1145","author":[{"given":"James C.","family":"Davis","sequence":"first","affiliation":[{"name":"Virginia Tech, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Christy A.","family":"Coghlan","sequence":"additional","affiliation":[{"name":"Virginia Tech, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Francisco","family":"Servant","sequence":"additional","affiliation":[{"name":"Virginia Tech, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dongyoon","family":"Lee","sequence":"additional","affiliation":[{"name":"Virginia Tech, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2018,10,26]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3106267"},{"key":"e_1_3_2_1_2_1","unstructured":"Alasdair Allan. 2012. Learning iOS Programming: From Xcode to App Store. O\u2019Reilly Media.   Alasdair Allan. 2012. Learning iOS Programming: From Xcode to App Store. O\u2019Reilly Media."},{"key":"e_1_3_2_1_3_1","unstructured":"Adam Baldwin. 2016.  Adam Baldwin. 2016."},{"key":"e_1_3_2_1_4_1","unstructured":"Regular Expression Denial of Service affecting Express.js. http:\/\/web.archive.org\/ web\/20170116160113\/https:\/\/medium.com\/node-security\/ regular-expression-denial-of-service-affecting-express-js-9c397c164c43.  Regular Expression Denial of Service affecting Express.js. http:\/\/web.archive.org\/ web\/20170116160113\/https:\/\/medium.com\/node-security\/ regular-expression-denial-of-service-affecting-express-js-9c397c164c43."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"crossref","first-page":"109","DOI":"10.4204\/EPTCS.151.7","article-title":"Analyzing Catastrophic Backtracking Behavior in Practical Regular Expression Matching","volume":"2014","author":"Berglund Martin","year":"2014","journal-title":"EPTCS: Automata and Formal Languages"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/2931037.2931073"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"crossref","unstructured":"Carl Chapman Peipei Wang and Kathryn T Stolee. 2017. Exploring Regular Expression Comprehension. In Automated Software Engineering (ASE).   Carl Chapman Peipei Wang and Kathryn T Stolee. 2017. Exploring Regular Expression Comprehension. In Automated Software Engineering (ASE).","DOI":"10.1109\/ASE.2017.8115653"},{"key":"e_1_3_2_1_8_1","unstructured":"Checkmarx. 2016. The Node.js Highway - Attacks are at Full Throttle. In BlackHat USA. https:\/\/www.youtube.com\/watch?v=-HzCUZDLXTc  Checkmarx. 2016. The Node.js Highway - Attacks are at Full Throttle. In BlackHat USA. https:\/\/www.youtube.com\/watch?v=-HzCUZDLXTc"},{"key":"e_1_3_2_1_9_1","unstructured":"Russ Cox. 2007. Regular Expression Matching Can Be Simple And Fast (but is slow in Java Perl PHP Python Ruby ...). https:\/\/swtch.com\/~rsc\/regexp\/regexp1.html  Russ Cox. 2007. Regular Expression Matching Can Be Simple And Fast (but is slow in Java Perl PHP Python Ruby ...). https:\/\/swtch.com\/~rsc\/regexp\/regexp1.html"},{"key":"e_1_3_2_1_10_1","unstructured":"Scott Crosby. 2003. Denial of service through regular expressions. USENIX Security work in progress report (2003).  Scott Crosby. 2003. Denial of service through regular expressions. USENIX Security work in progress report (2003)."},{"key":"e_1_3_2_1_11_1","unstructured":"Scott A Crosby and Dan S Wallach. 2003. Denial of Service via Algorithmic Complexity Attacks. In USENIX Security.   Scott A Crosby and Dan S Wallach. 2003. Denial of Service via Algorithmic Complexity Attacks. In USENIX Security."},{"key":"e_1_3_2_1_12_1","volume-title":"USENIX Security Symposium (USENIX Security).","author":"Davis James C","year":"2018"},{"key":"e_1_3_2_1_13_1","unstructured":"Erik DeBill. 2010. Module Counts. http:\/\/web.archive.org\/web\/20180114183225\/ http:\/\/www.modulecounts.com\/.  Erik DeBill. 2010. Module Counts. http:\/\/web.archive.org\/web\/20180114183225\/ http:\/\/www.modulecounts.com\/."},{"key":"e_1_3_2_1_14_1","unstructured":"Stack Exchange. 2016. Outage Postmortem. http:\/\/web.archive. org\/web\/20180801005940\/http:\/\/stackstatus.net\/post\/147710624694\/ outage-postmortem-july-20-2016.  Stack Exchange. 2016. Outage Postmortem. http:\/\/web.archive. org\/web\/20180801005940\/http:\/\/stackstatus.net\/post\/147710624694\/ outage-postmortem-july-20-2016."},{"key":"e_1_3_2_1_15_1","unstructured":"Maximiliano Firtman. 2013. Programming the Mobile Web: Reaching Users on iPhone Android BlackBerry Windows Phone and more. O\u2019Reilly Media.  Maximiliano Firtman. 2013. Programming the Mobile Web: Reaching Users on iPhone Android BlackBerry Windows Phone and more. O\u2019Reilly Media."},{"key":"e_1_3_2_1_16_1","unstructured":"Michael Fitzgerald. 2012. Introducing regular expressions. O\u2019Reilly Media Inc.  Michael Fitzgerald. 2012. Introducing regular expressions. O\u2019Reilly Media Inc."},{"key":"e_1_3_2_1_17_1","unstructured":"Jeffrey EF Friedl. 2002. Mastering regular expressions. O\u2019Reilly Media Inc.   Jeffrey EF Friedl. 2002. Mastering regular expressions. O\u2019Reilly Media Inc."},{"key":"e_1_3_2_1_18_1","unstructured":"Patrice Godefroid. 1995. Partial-Order Methods for the Verification of Concurrent Systems. Ph.D. Dissertation. University of Liege. 3-540-60761-7  Patrice Godefroid. 1995. Partial-Order Methods for the Verification of Concurrent Systems. Ph.D. Dissertation. University of Liege. 3-540-60761-7"},{"key":"e_1_3_2_1_19_1","volume-title":"Regular Expressions: The Complete Tutorial","author":"Goyvaerts Jan","year":"2006"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"crossref","unstructured":"Jan Goyvaerts and Steven Levithan. 2012. Regular expressions cookbook. O\u2019Reilly Media Inc.  Jan Goyvaerts and Steven Levithan. 2012. Regular expressions cookbook. O\u2019Reilly Media Inc.","DOI":"10.1016\/S1353-4858(12)70100-9"},{"key":"e_1_3_2_1_21_1","volume-title":"Static Analysis for Regular Expression Denial-of-Service Attacks. In International Conference on Network and System Security (NSS). 35\u2013148","author":"Kirrage James","year":"2013"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2012.12.026"},{"key":"e_1_3_2_1_23_1","volume-title":"7th International Conference for Internet Technology and Secured Transactions (ICITST).","author":"Ojamaa A","year":"2012"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134073"},{"key":"e_1_3_2_1_26_1","unstructured":"Randy J. Ray and Pavel Kulchenko. 2002. Programming Web Services with Perl. O\u2019Reilly Media.   Randy J. Ray and Pavel Kulchenko. 2002. Programming Web Services with Perl. O\u2019Reilly Media."},{"key":"e_1_3_2_1_27_1","unstructured":"Alex Roichman and Adar Weidman. 2009. VAC - ReDoS: Regular Expression Denial Of Service. Open Web Application Security Project (OWASP) (2009).  Alex Roichman and Adar Weidman. 2009. VAC - ReDoS: Regular Expression Denial Of Service. Open Web Application Security Project (OWASP) (2009)."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238159"},{"key":"e_1_3_2_1_29_1","unstructured":"Michael Sipser. 2006. Introduction to the Theory of Computation. Vol. 2. Thomson Course Technology Boston.  Michael Sipser. 2006. Introduction to the Theory of Computation. Vol. 2. Thomson Course Technology Boston."},{"key":"e_1_3_2_1_30_1","unstructured":"Snyk.io. 2018. Vulnerability DB. http:\/\/web.archive.org\/web\/20180801010155\/ https:\/\/snyk.io\/vuln.  Snyk.io. 2018. Vulnerability DB. http:\/\/web.archive.org\/web\/20180801010155\/ https:\/\/snyk.io\/vuln."},{"key":"e_1_3_2_1_31_1","unstructured":"Henry Spencer. 1994. A regular-expression matcher. In Software solutions in C. 35\u201371.   Henry Spencer. 1994. A regular-expression matcher. In Software solutions in C. 35\u201371."},{"key":"e_1_3_2_1_32_1","unstructured":"Cristian-Alexandru Staicu and Michael Pradel. 2018. Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers. In USENIX Security Symposium (USENIX Security). https:\/\/www.npmjs.com\/package\/safe-regexhttp: \/\/mp.binaervarianz.de\/ReDoS_TR_Dec2017.pdf   Cristian-Alexandru Staicu and Michael Pradel. 2018. Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers. In USENIX Security Symposium (USENIX Security). https:\/\/www.npmjs.com\/package\/safe-regexhttp: \/\/mp.binaervarianz.de\/ReDoS_TR_Dec2017.pdf"},{"key":"e_1_3_2_1_33_1","unstructured":"substack. 2013. safe-regex. https:\/\/web.archive.org\/web\/20180801003748\/https: \/\/github.com\/substack\/safe-regex.  substack. 2013. safe-regex. https:\/\/web.archive.org\/web\/20180801003748\/https: \/\/github.com\/substack\/safe-regex."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/363347.363387"},{"key":"e_1_3_2_1_36_1","unstructured":"https:\/\/www.fing.edu.uy\/inco\/cursos\/intropln\/material\/ p419-thompson.pdf  https:\/\/www.fing.edu.uy\/inco\/cursos\/intropln\/material\/ p419-thompson.pdf"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"crossref","unstructured":"Brink Van Der Merwe Nicolaas Weideman and Martin Berglund. 2017. Turning Evil Regexes Harmless. In SAICSIT.  Brink Van Der Merwe Nicolaas Weideman and Martin Berglund. 2017. Turning Evil Regexes Harmless. In SAICSIT.","DOI":"10.1145\/3129416.3129440"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3236024.3236072"},{"key":"e_1_3_2_1_39_1","volume-title":"Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)","author":"Weideman Nicolaas"},{"key":"e_1_3_2_1_40_1","unstructured":"Nicolaas Hendrik Weideman. 2017. Static Analysis of Regular Expressions. MS. Stellenbosch University.  Nicolaas Hendrik Weideman. 2017. Static Analysis of Regular Expressions. MS. Stellenbosch University."},{"key":"e_1_3_2_1_41_1","unstructured":"Wikipedia contributors. 2018. .NET Framework version history \u2014 Wikipedia The Free Encyclopedia. https:\/\/en.wikipedia.org\/w\/index.php?title=.NET_ Framework_version_history&oldid=851937435. {Online; accessed 1-August- 2018}.  Wikipedia contributors. 2018. .NET Framework version history \u2014 Wikipedia The Free Encyclopedia. https:\/\/en.wikipedia.org\/w\/index.php?title=.NET_ Framework_version_history&oldid=851937435. {Online; accessed 1-August- 2018}."},{"key":"e_1_3_2_1_42_1","unstructured":"Wikipedia contributors. 2018. Regular expression \u2014 Wikipedia The Free Encyclopedia. https:\/\/en.wikipedia.org\/w\/index.php?title=Regular_expression& oldid=852858998. {Online; accessed 1-August-2018}.  Wikipedia contributors. 2018. Regular expression \u2014 Wikipedia The Free Encyclopedia. https:\/\/en.wikipedia.org\/w\/index.php?title=Regular_expression& oldid=852858998. {Online; accessed 1-August-2018}."}],"event":{"name":"ESEC\/FSE '18: 26th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering","location":"Lake Buena Vista FL USA","acronym":"ESEC\/FSE '18","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3236024.3236027","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3236024.3236027","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3236024.3236027","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:57:25Z","timestamp":1750193845000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3236024.3236027"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,10,26]]},"references-count":40,"alternative-id":["10.1145\/3236024.3236027","10.1145\/3236024"],"URL":"https:\/\/doi.org\/10.1145\/3236024.3236027","relation":{},"subject":[],"published":{"date-parts":[[2018,10,26]]},"assertion":[{"value":"2018-10-26","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}