CVE-2026-11478: Kokke tiny-regex-c DoS Vulnerability

CVE-2026-11478 Overview

CVE-2026-11478 is a Regular Expression Denial of Service (ReDoS) vulnerability in the kokke/tiny-regex-c library, a small portable regex engine written in C. The flaw resides in the matchstar function within re.c, part of the Pattern Handler component. Crafted input patterns trigger inefficient regular expression complexity [CWE-400], causing excessive CPU consumption during pattern matching. The project follows a rolling release model, so no fixed version is published. The maintainer was notified through an issue report but has not responded at the time of disclosure. A proof-of-concept exploit is publicly available.

Critical Impact
Local attackers with low privileges can submit crafted regex inputs that consume excessive CPU resources, degrading availability of any application that links against tiny-regex-c.

Affected Products

kokke/tiny-regex-c up to commit f2632c6d9ed25272987471cdb8b70395c2460bdb
Applications and embedded systems statically linking tiny-regex-c
Downstream forks that reuse the vulnerable matchstar implementation

Discovery Timeline

2026-06-08 - CVE-2026-11478 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11478

Vulnerability Analysis

The vulnerability is an algorithmic complexity weakness in tiny-regex-c, classified under [CWE-400] Uncontrolled Resource Consumption. The matchstar function implements the Kleene star (*) operator using a recursive backtracking strategy. When the engine encounters a pattern that combines a greedy quantifier with overlapping alternations against a long input, the backtracking explores an exponential number of states.

Attackers exploit this by supplying either a malicious regex, a malicious input string, or both, against any application function that calls into the library. The result is sustained CPU saturation on the affected process, blocking legitimate work until the operation completes or the process is terminated.

A proof-of-concept archive (tiny-regex-c-redos-poc.zip) demonstrating the condition is published on GitHub. See the GitHub Issue #100 and VulDB CVE-2026-11478 entries for additional context.

Root Cause

The root cause is the use of naive recursive backtracking inside matchstar without any safeguards against catastrophic backtracking. The function repeatedly attempts to extend the match and recurses on failure, producing pathological runtime on adversarial inputs.

Attack Vector

Exploitation requires local access and low privileges on the host running the vulnerable application. The attacker supplies regex patterns or input data that reach matchstar. No user interaction is required, and the impact is limited to availability of the targeted process.

See the PoC ZIP File for a reproducer.

Detection Methods for CVE-2026-11478

Indicators of Compromise

Sustained 100% CPU utilization on a single thread within a process that links tiny-regex-c
Unresponsive applications or services that perform regex matching against attacker-supplied input
Unusually long-lived child processes invoking regex parsing routines

Detection Strategies

Audit dependency manifests and software bills of materials (SBOMs) for kokke/tiny-regex-c at or before commit f2632c6d9ed25272987471cdb8b70395c2460bdb
Profile processes that ingest untrusted strings into regex APIs and flag execution times exceeding a defined threshold
Add fuzz testing with adversarial regex inputs targeting the matchstar code path

Monitoring Recommendations

Alert on processes exceeding CPU time quotas while handling untrusted input
Log regex compilation and match operations along with input length and match duration
Correlate spikes in CPU usage with recent inputs received from low-privileged local users

How to Mitigate CVE-2026-11478

Immediate Actions Required

Inventory all applications, firmware images, and embedded components that link tiny-regex-c and identify exposure to untrusted regex input
Restrict which local users can submit regex patterns or inputs that reach the library
Enforce execution time limits and CPU quotas on processes that invoke regex matching

Patch Information

No official fix is available. The project uses a rolling release strategy, and the maintainer has not responded to the issue report referenced in GitHub Issue #100. Track upstream commits after f2632c6d9ed25272987471cdb8b70395c2460bdb for any remediation, and consider migrating to a regex engine with linear-time matching guarantees such as RE2 where feasible.

Workarounds

Validate and length-limit regex patterns and input strings before invoking re_match or re_matchp
Reject patterns containing nested or adjacent quantifiers that can trigger catastrophic backtracking in matchstar
Run regex evaluation in a sandboxed worker with a hard timeout and terminate on threshold breach
Replace tiny-regex-c with a linear-time alternative in security-sensitive code paths

bash

# Configuration example: enforce CPU and wall-clock limits on a regex worker via systemd
# /etc/systemd/system/regex-worker.service
[Service]
ExecStart=/usr/local/bin/regex-worker
CPUQuota=25%
LimitCPU=2
TimeoutStopSec=5
MemoryMax=128M