Hacker News Reader

This paper goes over the Cloudflare outage, and other runaway regex CVEs with MediaWiki, Stackoverflow, and the Atom editor:

https://vtechworks.lib.vt.edu/bitstream/handle/10919/98593/D...

While atomic grouping can prevent this from happening again once you've already found the problem, the real solution is just making sure there is a timeout on your web process. That way even if you hit catastrophic backtracking, your servers aren't going to be unavailable unless someone is purposely reDOSing them.

There's a cool tool to detect regexes like these in your code: https://github.com/doyensec/regexploit

(disclosure: I work for Doyensec)

The gif showing the backtracking is cool. I wonder if there's similar tool for python.