ReDoS — Regular Expression Denial of Service

Some regular expression patterns cause the regex engine to enter exponential backtracking on certain inputs. The engine tries every possible way to match the pattern before giving up, and each additional character doubles the number of combinations.

In serverless, this is especially dangerous. A single HTTP request with a crafted string can make a Lambda function spin at 100% CPU until it hits its timeout (default: 6 seconds, max: 15 minutes). The function is unresponsive during this time, and you pay for every millisecond of execution.

One request, one regex, one string — that is all it takes for a denial of service. No botnets, no traffic floods. Just a carefully chosen input.

ReDoS has caused outages at Cloudflare (2019) and Stack Overflow, and is a common finding in bug bounty programs.

OWASP Serverless Top 10: SLS-10 — Event Injection / ReDoS