---
title: Avoid regular expressions vulnerable to ReDoS
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Avoid regular expressions vulnerable to ReDoS
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Avoid regular expressions vulnerable to ReDoS

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `dart-security/regex-dos`

**Language:** Dart

**Severity:** Warning

**Category:** Security

**CWE**: [1333](https://cwe.mitre.org/data/definitions/1333.html)

## Description{% #description %}

Regular expressions with nested quantifiers such as `(a+)+`, `(.*)*`, or `([a-z]+)+` cause catastrophic backtracking on crafted input, consuming exponential time and hanging the application. Rewrite the pattern to eliminate ambiguous grouping, use possessive quantifiers where supported, or enforce input-length limits before matching untrusted strings.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```dart
void main() {
  final a = RegExp(r'(a+)+');
  final b = RegExp('(.*)*');
  final c = RegExp(r'([a-z]+)+');
}
```

## Compliant Code Examples{% #compliant-code-examples %}

```dart
void main() {
  final group = RegExp(r'(abc)+');
  final single = RegExp(r'[a-z]+');
  final sequential = RegExp(r'a+b+');
  final alternation = RegExp(r'(foo|bar)+');
  final bounded = RegExp(r'\d{1,3}');
  final boundedOuter = RegExp(r'(a+){2}');
  final ipv4 = RegExp(r'(\d{1,3}\.){3}\d{1,3}');
  final nestedNoQuant = RegExp(r'((abc))+');
}
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}