Document Open Access Logo

On the Complexity of the Matching Problem of Regular Expressions with Backreferences

Authors Soh Kumabe , Yuya Uezato

PDF

File

Thumbnail PDF
PDF
LIPIcs.ICALP.2026.135.pdf
  • Filesize: 1.09 MB
  • 25 pages

Document Identifiers

Related Versions

Subject Classification

ACM Subject Classification
  • Theory of computation → Pattern matching
  • Theory of computation → Formal languages and automata theory
Keywords
  • Pattern Matching
  • Regular Expression
  • Backreference
  • Fine-grained Complexity

Metrics

Abstract

Regular Expression Denial of Service (ReDoS) is a well-known type of algorithmic complexity attack, where an adversary supplies maliciously crafted strings to a regular expression matching engine, aiming to exhaust computational resources of systems. Even quadratic-time behavior in matching engines has been exploited in successful attacks, as exemplified by major outages at Stack Overflow (2016) and Cloudflare (2019). These incidents motivate a fundamental question: Is it possible to construct matching engines that run in linear or near-linear time in the length of the input string? For classical regular expressions (REGEX), Thompson’s construction yields a linear-time algorithm for fixed expressions. However, practical engines support powerful features such as backreferences, which allow capturing a substring and reusing it later. This feature strictly extends the expressive power of REGEX but unfortunately increases the risk of ReDoS attacks.
This paper investigates the fine-grained complexity of the string matching problem for regular expressions with backreferences (REWBs). Specifically, we consider r-use k-REWBs, i.e., REWBs with k variables such that, in any computation, the total number of backreference executions is at most r. On the hardness side, we show that the string matching problem for k-REWBs cannot be solved in O(n^{2k-ε}) time for any ε > 0 under the Strong Exponential Time Hypothesis (SETH), where n is the length of the input string. We also prove that this problem is W[2]-hard when parameterized by the length of the REWB expression, strengthening the previous W[1]-hardness result. Moreover, we prove that this problem for 2-use 2-REWBs cannot be solved in n^{1+o(1)} time unless the triangle detection problem can be solved in that time. On the algorithmic side, we present an O(n log² n)-time algorithm for 1-use REWBs. In particular, we focus on the ABCBD problem, which is the REWB matching problem for the form A(B)_xC∖xD where A, B, C, and D are fixed REGEXes. We also show that every 1-use REWB can be transformed into this canonical form. Our algorithm significantly improves upon the recent O(n²)-time algorithm for the ABCBD problem by Nogami and Terauchi (MFCS, 2025). Our algorithm is highly nontrivial and employs several techniques, including suffix trees, transition monoids of REGEXes, factorization forest data structures, and periodicity of strings.

Cite As Get BibTex

Soh Kumabe and Yuya Uezato. On the Complexity of the Matching Problem of Regular Expressions with Backreferences. In 53rd International Colloquium on Automata, Languages, and Programming (ICALP 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 374, pp. 135:1-135:25, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/LIPIcs.ICALP.2026.135

Author Details

Soh Kumabe
  • CyberAgent, Inc., Tokyo, Japan
Yuya Uezato
  • CyberAgent, Inc., Tokyo, Japan
  • National Institute of Informatics, Tokyo, Japan

Funding

  • Uezato, Yuya: Yuya Uezato was supported by JST, CREST Grant Number JPMJCR21M3.

Acknowledgements

We are grateful to the anonymous reviewers for their careful reading and valuable comments. We are especially indebted to the anonymous reviewers of an earlier version of this work, whose detailed and constructive feedback led to substantial improvements in the technical exposition, the organization, and the overall clarity of the paper.

References

  1. Amir Abboud and Virginia Vassilevska Williams. Popular conjectures imply strong lower bounds for dynamic problems. In FOCS 2014, pages 434-443. IEEE Computer Society, 2014. URL: https://doi.org/10.1109/FOCS.2014.53.
  2. Alfred V. Aho. Algorithms for finding patterns in strings. In Jan van Leeuwen, editor, Handbook of Theoretical Computer Science, Volume A: Algorithms and Complexity, pages 255-300. MIT Press, 1990. URL: https://doi.org/10.1016/B978-0-444-88071-0.50010-2.
  3. Alfred V. Aho, Ravi Sethi, and Jeffrey D. Ullman. Compilers: Principles, Techniques, and Tools. Addison-Wesley, 1986. URL: https://www.worldcat.org/oclc/12285707.
  4. Amihood Amir, Tsvi Kopelowitz, Avivit Levy, Seth Pettie, Ely Porat, and B. Riva Shalom. Mind the gap! online dictionary matching with one gap. Algorithmica, 81:2123-2157, 2019. URL: https://doi.org/10.1007/s00453-018-0526-2.
  5. Dana Angluin. Finding patterns common to a set of strings (extended abstract). In STOC 1979, pages 130-141. ACM, 1979. URL: https://doi.org/10.1145/800135.804406.
  6. Dana Angluin. Finding patterns common to a set of strings. JCSS, 21(1):46-62, 1980. URL: https://doi.org/10.1016/0022-0000(80)90041-0.
  7. Arturs Backurs and Piotr Indyk. Which Regular Expression Patterns Are Hard to Match? In FOCS 2016, pages 457-466. IEEE Computer Society, 2016. URL: https://doi.org/10.1109/FOCS.2016.56.
  8. Aurèle Barrière and Clément Pit-Claudel. Linear matching of JavaScript regular expressions. Proc. ACM Program. Lang., 8(PLDI), June 2024. URL: https://doi.org/10.1145/3656431.
  9. Martin Berglund and Brink van der Merwe. Re-examining regular expressions with backreferences. Theor. Comput. Sci., 940(Part):66-80, 2023. URL: https://doi.org/10.1016/j.tcs.2022.10.041.
  10. Philip Bille and Inge Li Gørtz. Sparse regular expression matching. In SODA 2024, pages 3354-3375. SIAM, 2024. URL: https://doi.org/10.1137/1.9781611977912.120.
  11. Philip Bille, Inge Li Gørtz, Hjalte Wedel Vildhøj, and David Kofoed Wind. String matching with variable length gaps. Theor. Comput. Sci., 443:25-34, 2012. URL: https://doi.org/10.1016/j.tcs.2012.03.029.
  12. Karl Bringmann, Allan Grønlund, Marvin Künnemann, and Kasper Green Larsen. The NFA Acceptance Hypothesis: Non-Combinatorial and Dynamic Lower Bounds. In ITCS 2024, volume 287 of LIPIcs, pages 22:1-22:25. Schloss Dagstuhl, 2024. URL: https://doi.org/10.4230/LIPIcs.ITCS.2024.22.
  13. Aria Buckles. simple-markdown: inlinecode: Fix ReDoS & improve escape semantics (commit 89797fe). GitHub commit, 2019. URL: https://github.com/ariabuckles/simple-markdown/commit/89797fe.
  14. Ashok K. Chandra, Dexter C. Kozen, and Larry J. Stockmeyer. Alternation. J. ACM, 28(1):114-133, January 1981. URL: https://doi.org/10.1145/322234.322243.
  15. Agnishom Chattopadhyay, Angela W. Li, and Konstantinos Mamouras. Verified and efficient matching of regular expressions with lookaround. In CPP 2025, pages 198-213. ACM, 2025. URL: https://doi.org/10.1145/3703595.3705884.
  16. Russ Cox. Regular expression matching can be simple and fast. https://swtch.com/~rsc/regexp/regexp1.html, January 2007.
  17. Russ Cox. Regular expression matching in the wild. https://swtch.com/~rsc/regexp/regexp3.html, March 2010.
  18. Max Crochemore. An optimal algorithm for computing the repetitions in a word. Inf. Process. Lett., 12(5):244-250, 1981. URL: https://doi.org/10.1016/0020-0190(81)90024-7.
  19. Maxime Crochemore, Christophe Hancart, and Thierry Lecroq. Algorithms on Strings. Cambridge University Press, 2007. URL: https://doi.org/10.1017/CBO9780511546853.
  20. Scott A. Crosby. Denial of service through regular expressions. Presentation at the 12th USENIX Security Symposium, 2003. URL: https://www.usenix.org/conference/12th-usenix-security-symposium/denial-service-through-regular-expressions.
  21. Scott A. Crosby and Dan S. Wallach. Denial of service via algorithmic complexity attacks. In USENIX Security 03. USENIX Association, 2003. URL: https://www.usenix.org/conference/12th-usenix-security-symposium/denial-service-algorithmic-complexity-attacks.
  22. Marek Cygan, Fedor V. Fomin, Lukasz Kowalik, Daniel Lokshtanov, Dániel Marx, Marcin Pilipczuk, Michal Pilipczuk, and Saket Saurabh. Parameterized Algorithms. Springer, 2015. URL: https://doi.org/10.1007/978-3-319-21275-3.
  23. Robert Dąbrowski and Wojciech Plandowski. On word equations in one variable. Algorithmica, 60(4):819-828, August 2011. URL: https://doi.org/10.1007/s00453-009-9375-3.
  24. Robert Dąbrowski and Wojtek Plandowski. Solving two-variable word equations (extended abstract). In ICALP 2004, volume 3142 of Lecture Notes in Computer Science, pages 408-419. Springer, 2004. URL: https://doi.org/10.1007/978-3-540-27836-8_36.
  25. James C. Davis, Francisco Servant, and Dongyoon Lee. Using selective memoization to defeat regular expression denial of service (ReDoS). In S&P 2021, pages 1-17, 2021. URL: https://doi.org/10.1109/SP40001.2021.00032.
  26. Volker Diekert, Claudio Gutierrez, and Christian Hagenah. The existential theory of equations with rational constraints in free groups is PSPACE-complete. Inf. Comput., 202(2):105-140, 2005. URL: https://doi.org/10.1016/j.ic.2005.04.002.
  27. Rod G. Downey and Michael R. Fellows. Fixed-parameter tractability and completeness i: Basic results. SIAM Journal on Computing, 24(4):873-921, 1995. URL: https://doi.org/10.1137/S0097539792228228.
  28. Lech Duraj, Marvin Künnemann, and Adam Polak. Tight conditional lower bounds for longest common increasing subsequence. Algorithmica, 81(10):3968-3992, 2019. URL: https://doi.org/10.1007/S00453-018-0485-7.
  29. Andrzej Ehrenfeucht and Grzegorz Rozenberg. Finding a homomorphism between two words in NP-complete. Inf. Process. Lett., 9(2):86-88, 1979. URL: https://doi.org/10.1016/0020-0190(79)90135-2.
  30. Henning Fernau, Florin Manea, Robert Mercaş, and Markus L. Schmid. Pattern Matching with Variables: Fast Algorithms and New Hardness Results. In STACS 2015, volume 30 of LIPIcs, pages 302-315. Schloss Dagstuhl, 2015. URL: https://doi.org/10.4230/LIPIcs.STACS.2015.302.
  31. Henning Fernau, Florin Manea, Robert Mercaş, and Markus L. Schmid. Pattern matching with variables: Efficient algorithms and complexity results. ACM Trans. Comput. Theory, 12(1), February 2020. URL: https://doi.org/10.1145/3369935.
  32. Henning Fernau and Markus L. Schmid. Pattern matching with variables: A multivariate complexity analysis. Inf. Comput., 242:287-305, 2015. URL: https://doi.org/10.1016/j.ic.2015.03.006.
  33. Henning Fernau, Markus L. Schmid, and Yngve Villanger. On the parameterised complexity of string morphism problems. Theory of Computing Systems, 59(1):24-51, 2016. URL: https://doi.org/10.1007/s00224-015-9635-3.
  34. Kimmo Fredriksson and Szymon Grabowski. Efficient algorithms for pattern matching with general gaps, character classes, and transposition invariance. Information Retrieval, 11:335-357, 2008. URL: https://doi.org/10.1007/s10791-008-9054-z.
  35. Dominik D. Freydenberger and Markus L. Schmid. Deterministic regular expressions with back-references. J. Comput. Syst. Sci., 105:1-39, 2019. URL: https://doi.org/10.1016/j.jcss.2019.04.001.
  36. Jeffrey Friedl. Mastering Regular Expressions. O'Reilly, 2006. URL: https://www.oreilly.com/library/view/mastering-regular-expressions/0596528124/.
  37. Hiroya Fujinami and Ichiro Hasuo. Efficient matching with memoization for regexes with look-around and atomic grouping. In ESOP 2024, volume 14577 of Lecture Notes in Computer Science, pages 90-118. Springer, 2024. URL: https://doi.org/10.1007/978-3-031-57267-8_4.
  38. Anka Gajentaan and Mark H. Overmars. On a class of O(n²) problems in computational geometry. Computational Geometry, 5(3):165-185, 1995. URL: https://doi.org/10.1016/0925-7721(95)00022-2.
  39. Jan Goyvaerts. Runaway Regular Expressions: Catastrophic Backtracking. https://www.regular-expressions.info/catastrophic.html, 2021.
  40. Jan Goyvaerts. Atomic grouping. https://www.regular-expressions.info/atomic.html, 2025.
  41. Jan Goyvaerts. Lookahead and Lookbehind Zero-Length Assertions. https://www.regular-expressions.info/lookaround.html, 2025.
  42. Jan Goyvaerts. Repetition with star and plus. https://www.regular-expressions.info/repeat.html, 2025.
  43. John Graham-Cumming. Details of the Cloudflare outage on July 2, 2019. Cloudflare Blog. Archived at https://web.archive.org/web/20190712160002/https://blog.cloudflare.com/details-of-the-cloudflare-outage-on-july-2-2019/, July 2019.
  44. Tuukka Haapasalo, Panu Silvasti, Seppo Sippu, and Eljas Soisalon-Soininen. Online dictionary matching with variable-length gaps. In Experimental Algorithms, volume 6630 of Lecture Notes in Computer Science, pages 76-87. Springer, 2011. URL: https://doi.org/10.1007/978-3-642-20662-7_7.
  45. Jakob Cetti Hansen, Adam Husted Kjelstrøm, and Andreas Pavlogiannis. Tight bounds for reachability problems on one-counter and pushdown systems. Inf. Process. Lett., 171:106135, 2021. URL: https://doi.org/10.1016/j.ipl.2021.106135.
  46. Wing-Kai Hon, Tak-Wah Lam, Rahul Shah, Sharma V. Thankachan, Hing-Fung Ting, and Yilin Yang. Dictionary matching with a bounded gap in pattern or in text. Algorithmica, 80:698-713, 2018. URL: https://doi.org/10.1007/s00453-017-0288-2.
  47. Oscar H. Ibarra, Ting-Chuen Pong, and Stephen M. Sohn. A note on parsing pattern languages. Pattern Recognit. Lett., 16(2):179-182, 1995. URL: https://doi.org/10.1016/0167-8655(94)00091-G.
  48. Artur Jeż. One-variable word equations in linear time. Algorithmica, 74(1):1-48, 2016. URL: https://doi.org/10.1007/s00453-014-9931-3.
  49. Artur Jeż. Recompression: A simple and powerful technique for word equations. J. ACM, 63(1), February 2016. URL: https://doi.org/10.1145/2743014.
  50. Artur Jeż. Solving Word Equations (And Other Unification Problems) by Recompression. In CSL 2020, volume 152 of LIPIcs, pages 3:1-3:17. Schloss Dagstuhl, 2020. URL: https://doi.org/10.4230/LIPIcs.CSL.2020.3.
  51. Tao Jiang, Efim Kinber, Arto Salomaa, Kai Salomaa, and Sheng Yu. Pattern languages with and without erasing. International Journal of Computer Mathematics, 50(3-4):147-163, 1994. URL: https://doi.org/10.1080/00207169408804252.
  52. Tsvi Kopelowitz, Seth Pettie, and Ely Porat. Higher lower bounds from the 3SUM conjecture. In SODA 2016, pages 1272-1287. SIAM, 2016. URL: https://doi.org/10.1137/1.9781611974331.ch89.
  53. Soh Kumabe and Yuya Uezato. On the complexity of the matching problem of regular expressions with backreferences, 2026. URL: https://arxiv.org/abs/2605.07289.
  54. Richard E. Ladner, Richard J. Lipton, and Larry J. Stockmeyer. Alternating pushdown and stack automata. SIAM Journal on Computing, 13(1):135-155, 1984. URL: https://doi.org/10.1137/0213010.
  55. Avivit Levy and B. Riva Shalom. A comparative study of dictionary matching with gaps: Limitations, techniques and challenges. Algorithmica, 84:590-638, 2022. URL: https://doi.org/10.1007/s00453-021-00851-6.
  56. Konstantinos Mamouras and Agnishom Chattopadhyay. Efficient matching of regular expressions with lookaround assertions. Proc. ACM Program. Lang., 8(POPL), January 2024. URL: https://doi.org/10.1145/3632934.
  57. Alexandru Mateescu and Arto Salomaa. Aspects of classical language theory. In Grzegorz Rozenberg and Arto Salomaa, editors, Handbook of Formal Languages, Volume 1: Word, Language, Grammar, pages 175-251. Springer, 1997. URL: https://doi.org/10.1007/978-3-642-59136-5_4.
  58. MITRE. CWE-1333: Inefficient Regular Expression Complexity. https://cwe.mitre.org/data/definitions/1333.html, 2021. CWE version 4.17. Page last updated: 2025-04-03.
  59. National Vulnerability Database (NVD). CVE-2017-16114, 2017. URL: https://nvd.nist.gov/vuln/detail/CVE-2017-16114.
  60. National Vulnerability Database (NVD). CVE-2019-25103, 2019. URL: https://nvd.nist.gov/vuln/detail/CVE-2019-25103.
  61. National Vulnerability Database (NVD). CVE-2021-21240. https://nvd.nist.gov/vuln/detail/CVE-2021-21240, 2021. GitHub Advisory: URL: https://github.com/advisories/GHSA-93xj-8mrv-444m.
  62. National Vulnerability Database (NVD). CVE-2023-39663. https://nvd.nist.gov/vuln/detail/CVE-2023-39663, 2023. GitHub Advisory: https://github.com/advisories/GHSA-v638-q856-grg8.
  63. National Vulnerability Database (NVD). CVE-2023-6159. https://nvd.nist.gov/vuln/detail/cve-2023-6159, 2023. GitLab Security Release: https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/.
  64. National Vulnerability Database (NVD). CVE-2024-26142. https://nvd.nist.gov/vuln/detail/CVE-2024-26142, 2024. GitHub Advisory: URL: https://github.com/advisories/GHSA-jjhx-jhvp-74wq.
  65. National Vulnerability Database (NVD). CVE-2024-28865. https://nvd.nist.gov/vuln/detail/CVE-2024-28865, 2024. GitHub Advisory: URL: https://github.com/advisories/GHSA-wj85-w4f4-xh8h.
  66. National Vulnerability Database (NVD). CVE-2025-25200. https://nvd.nist.gov/vuln/detail/CVE-2025-25200, 2025. GitHub Advisory: URL: https://github.com/advisories/GHSA-593f-38f6-jp5m.
  67. National Vulnerability Database (NVD). CVE-2025-29907. https://nvd.nist.gov/vuln/detail/CVE-2025-29907, 2025. GitHub Advisory: URL: https://github.com/advisories/GHSA-w532-jxjh-hjhj.
  68. National Vulnerability Database (NVD). CVE-2025-5197. https://nvd.nist.gov/vuln/detail/CVE-2025-5197, 2025. GitHub Advisory: URL: https://github.com/advisories/GHSA-9356-575x-2w9m.
  69. Gonzalo Navarro and Mathieu Raffinot. Fast and simple character classes and bounded gaps pattern matching, with applications to protein searching. Journal of Computational Biology, 10(6):903-923, 2003. URL: https://doi.org/10.1089/106652703322756140.
  70. Taisei Nogami and Tachio Terauchi. Efficient matching of some fundamental regular expressions with backreferences. In MFCS 2025, volume 345 of LIPIcs, pages 81:1-81:19. Schloss Dagstuhl, 2025. URL: https://doi.org/10.4230/LIPIcs.MFCS.2025.81.
  71. Taisei Nogami and Tachio Terauchi. Hardness of regular expression matching with extensions, 2026. URL: https://doi.org/10.48550/arXiv.2601.03020.
  72. Mihai Pătraşcu. Towards polynomial lower bounds for dynamic problems. In STOC 2010, pages 603-610. ACM, 2010. URL: https://doi.org/10.1145/1806689.1806772.
  73. Mihai Pătraşcu and Ryan Williams. On the possibility of faster SAT algorithms. In SODA 2010, pages 1065-1075. SIAM, 2010. URL: https://doi.org/10.1137/1.9781611973075.86.
  74. Wojciech Plandowski. Satisfiability of word equations with constants is in PSPACE. J. ACM, 51(3):483-496, May 2004. URL: https://doi.org/10.1145/990308.990312.
  75. Markus L. Schmid. Regular expressions with backreferences: Polynomial-time matching techniques. J. Autom. Lang. Comb., 29(2-4):321-357, 2024. URL: https://doi.org/10.25596/jalc-2024-321.
  76. Klaus U. Schulz. Makanin’s algorithm for word equations - two improvements and a generalization. In Word Equations and Related Topics, First International Workshop, IWWERT '90, volume 572 of Lecture Notes in Computer Science, pages 85-150. Springer, 1990. URL: https://doi.org/10.1007/3-540-55124-7_4.
  77. Takeshi Shinohara. Polynomial time inference of extended regular pattern languages. In RIMS Symposia on Software Science and Engineering, pages 115-127. Springer, 1983. URL: https://doi.org/10.1007/3-540-11980-9_19.
  78. Stack Exchange. Outage Postmortem - July 20, 2016. Stack Exchange Network Status Blog. Archived at https://web.archive.org/web/20180801005940/http://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016, July 2016.
  79. Frank Stephan, Ryo Yoshinaka, and Thomas Zeugmann. On the parameterised complexity of learning patterns. In Computer and Information Sciences II, pages 277-281. Springer, 2012. URL: https://doi.org/10.1007/978-1-4471-2155-8_35.
  80. Ken Thompson. Programming techniques: Regular expression search algorithm. Commun. ACM, 11(6):419-422, June 1968. URL: https://doi.org/10.1145/363347.363387.
  81. Yuya Uezato. Regular Expressions with Backreferences and Lookaheads Capture NLOG. In ICALP 2024, volume 297 of LIPIcs, pages 155:1-155:20. Schloss Dagstuhl, 2024. URL: https://doi.org/10.4230/LIPIcs.ICALP.2024.155.
  82. UziTech. marked: fix inline code regex (commit 3271b8b). GitHub commit, 2018. URL: https://github.com/markedjs/marked/commit/3271b8b.
  83. Ryan Williams. A new algorithm for optimal 2-constraint satisfaction and its implications. Theor. Comput. Sci., 348(2-3):357-365, 2005. URL: https://doi.org/10.1016/j.tcs.2005.09.023.
  84. Virginia Vassilevska Williams. On some fine-grained questions in algorithms and complexity. In Proceedings of the International Congress of Mathematicians (ICM 2018). WORLD SCIENTIFIC, 2019. URL: https://doi.org/10.1142/9789813272880_0188.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact