Skip to content

Injection and Smuggling · payload topic

Regular Expression

3 passages · 4 code blocks

Every mark is a titled passage of this topic's pages, in reading order; the brighter ones carry code. For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open Regular Expression on GitHub

Regular Expression Denial of Service (ReDoS) is a type of attack that exploits the fact that certain regular expressions can take an extremely long time to process, causing applications or services to become unresponsive or crash.

Source: PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 3 is a mark on the map. Named now: 1 to 3, reading order first.

  1. Regular Expression§ 1text · README.md
  2. Evil Regex§ 21 code block · README.md
  3. Backtrack Limit§ 33 code blocks · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

Updated AboutDevelopersSign in