courses.reviews logo
I launched a free website to help you find the best courses with reviews & discounts.
Up to date
Published
4 min read

Trevor I. Lasn

Staff Software Engineer, Engineering Manager

When Regex Goes Wrong

Issues and catastrophic failures caused by regex

In 2016, Stack Overflow experienced a 34-minute outage. The root cause? A regular expression (Regex) used in a part of the code that handled user input.

It took 10 minutes to pinpoint the issue, 14 minutes to write the fix, and another 10 minutes to deploy the solution and restore Stack Overflow’s availability.

What caused the outage?

^[\s\u200c]+|[\s\u200c]+$

According to Stack Overflow: “While this looks straightforward—matching ‘all the spaces at the end of the string’—it can be problematic for backtracking regex engines. In this case, a malformed post included roughly 20,000 consecutive whitespace characters on a comment line.

If the string contains 20,000 space characters in a row but not at the end, the regex engine starts checking each space. After the 20,000th space, it encounters a different character but still expects a space or the end of the string.

The engine backtracks, attempting to match \s+$ starting from the second space, the third space, and so on, leading to a total of 199,990,000 checks. This was sufficient to cause a significant delay. The regex has since been replaced with a substring function.”

What Is Backtracking?

Backtracking occurs when a regular expression fails to match part of a string. While matching itself is straightforward, if a regex engine cannot find a match, it starts backtracking. This means the engine revisits previous choices and attempts different options, which can lead to performance issues.

Catastrophic Backtracking

In addition to general backtracking, there is a specific issue known as catastrophic backtracking. This happens when a regex engine spends an excessive amount of time trying different combinations to match a pattern, often leading to severe performance degradation. This is especially problematic with complex regex patterns and large input sizes.

The Stack Overflow incident serves as a reminder of the potential pitfalls of using regex. While a 34-minute outage might not seem like a major issue, what other problems has regex caused?

Cloudflare Outage (2019)

The CloudFlare outage on July 2, 2019, was another major example of how regex issues can lead to catastrophic failures.

An engineer wrote a regular expression prone to severe backtracking. This regex led to widespread CPU exhaustion, causing Cloudflare’s global CPU usage to spike to 100%.

(?:(?:\"|'|\]|\}|\\|\d|(?:nan|infinity|true|false|null|undefined|symbol|math)|\`|\-|\+)+[)]*;?((?:\s|-|~|!|{}|\|\||\+)*.*(?:.*=.*)))

According to Cloudflare: “The regex was designed in a way that could cause significant backtracking. The critical part of the regex,.*(?:.*=.*)., involves a non-capturing group, which can lead to excessive CPU usage when processing certain patterns. This inefficiency in the regex caused severe performance issues, ultimately leading to a massive outage.”

CrowdStrike Kernel Issue (2024)

Recently, CrowdStrike faced a major issue due to a poorly implemented regular expression in their kernel driver, leading to widespread system crashes. This incident disrupted operations across various sectors, including businesses and government systems.

The root cause of the problem was a mismatch between the expected number of input parameters (21) and the actual number provided (20) to the Content Interpreter, which was responsible for processing regex-based Rapid Response Content. When the system received input with the 21st parameter, the Content Interpreter attempted to read beyond the allocated memory, resulting in out-of-bounds access and subsequent system crashes.

This incident shows the serious problems regex can cause in critical systems.

Should We Move Away from Regex?

I’m not claiming to know everything about regex. However, their issues highlight why we need to be careful with regex and explore alternative solutions. Is it time to phase them out?​


Found this article helpful? You might enjoy my free newsletter. I share dev tips and insights to help you grow your coding skills and advance your tech career.

Interested in supporting this blog in exchange for a shoutout? Get in touch.


Liked this post?

Check out these related articles that might be useful for you. They cover similar topics and provide additional insights.

Tech
3 min read

Amazon's 'No Weasel Words' Rule

How Amazon's emphasis on eliminating weasel words leads to more precise, actionable communication and better decision-making

Sep 17, 2024
Read article
Tech
3 min read

When Will We Have Our First AI CEO?

Welcome to the future of corporate leadership. It's efficient, profitable, and utterly inhuman

Nov 4, 2024
Read article
Tech
11 min read

Google's Journey: From Search Engine to Tech Giant

Exploring the key innovations and strategies that transformed Google into a global technology leader

Oct 1, 2024
Read article
Tech
5 min read

Cloudflare's AI Content Control: Savior or Threat to the Open Web?

How Cloudflare's new AI management tools could revolutionize content creation, potentially reshaping the internet landscape for both website owners and AI companies.

Sep 24, 2024
Read article
Tech
3 min read

Open-source is where dreams go to die

Work for free and in return watch your passion get crushed by entitled users who are never satisfied

Feb 26, 2025
Read article
Tech
5 min read

Cloudflare Study: 39% of Companies Losing Control of Their IT and Security Environment

New research reveals a shocking loss of control in corporate IT environments

Oct 3, 2024
Read article
Tech
3 min read

Tattoos Won't Break Your Tech Career

Building a tech career with a sword tattooed on my neck

Dec 10, 2024
Read article
Tech
5 min read

Is Age Really a Factor in Tech?

Silicon Valley has a reputation for youth worship. The 'move fast and break things' mentality often translates to a preference for younger, supposedly more adaptable workers.

Oct 8, 2024
Read article
Tech
4 min read

Why I moved from Google Analytics to Simple Analytics

I ditched Google Analytics for a privacy-focused analytics tool that bypasses ad blockers

Nov 9, 2024
Read article

This article was originally published on https://www.trevorlasn.com/blog/when-regex-goes-wrong. It was written by a human and polished using grammar tools for clarity.