On the Complexity of the Matching Problem of
Regular Expressions with Backreferences
Abstract
Regular Expression Denial of Service (ReDoS) is a well-known type of algorithmic complexity attack, where an adversary supplies maliciously crafted strings to a regular expression matching engine, aiming to exhaust computational resources of systems. Even quadratic-time behavior in matching engines has been exploited in successful attacks, as exemplified by major outages at Stack Overflow (2016) and Cloudflare (2019). These incidents motivate a fundamental question: Is it possible to construct matching engines that run in linear or near-linear time in the length of the input string? For classical regular expressions (REGEX), Thompson’s construction yields a linear-time algorithm for fixed expressions. However, practical engines support powerful features such as backreferences, which allow capturing a substring and reusing it later. This feature strictly extends the expressive power of REGEX but unfortunately increases the risk of ReDoS attacks.
This paper investigates the fine-grained complexity of the string matching problem for regular expressions with backreferences (REWBs). Specifically, we consider -use -REWBs, i.e., REWBs with variables such that, in any computation, the total number of backreference executions is at most . On the hardness side, we show that the string matching problem for -REWBs cannot be solved in time for any under the Strong Exponential Time Hypothesis (SETH), where is the length of the input string. We also prove that this problem is W[2]-hard when parameterized by the length of the REWB expression, strengthening the previous W[1]-hardness result. Moreover, we prove that this problem for -use -REWBs cannot be solved in time unless the triangle detection problem can be solved in that time. On the algorithmic side, we present an -time algorithm for -use REWBs. In particular, we focus on the ABCBD problem, which is the REWB matching problem for the form where , , , and are fixed REGEXes. We also show that every -use REWB can be transformed into this canonical form. Our algorithm significantly improves upon the recent -time algorithm for the ABCBD problem by Nogami and Terauchi (MFCS, 2025). Our algorithm is highly nontrivial and employs several techniques, including suffix trees, transition monoids of REGEXes, factorization forest data structures, and periodicity of strings.
Keywords and phrases:
Pattern Matching, Regular Expression, Backreference, Fine-grained ComplexityCategory:
Track A: Algorithms, Complexity and GamesFunding:
Yuya Uezato: Yuya Uezato was supported by JST, CREST Grant Number JPMJCR21M3.Copyright and License:
2012 ACM Subject Classification:
Theory of computation Pattern matching ; Theory of computation Formal languages and automata theoryAcknowledgements:
We are grateful to the anonymous reviewers for their careful reading and valuable comments. We are especially indebted to the anonymous reviewers of an earlier version of this work, whose detailed and constructive feedback led to substantial improvements in the technical exposition, the organization, and the overall clarity of the paper.Editors:
Sayan Bhattacharya, Danupon Nanongkai, Michael Benedikt, and Gabriele PuppisSeries and Publisher:
Leibniz International Proceedings in Informatics, Schloss Dagstuhl – Leibniz-Zentrum für Informatik
1 Introduction
Background.
Regular expressions are widely used in web services to validate and filter user-provided text. However, depending on the engine implementation and the specific expressions used, the worst-case regular expression matching time can be prohibitive. In most web-service settings, expressions are fixed by the application, while the input string is provided by potentially untrusted users. In such cases, an adversary can craft inputs that trigger the worst-case behavior, potentially exhausting computational resources (CPU and memory) and causing service outages.
Attacks that exploit such worst-case algorithmic behavior are known as algorithmic complexity attacks [21]. Those specifically involving regular expressions are called ReDoS (Regular Expression Denial of Service) [20]. ReDoS is a major vulnerability and is cataloged in the Common Weakness Enumeration (CWE, the de facto standard for vulnerability classification) as CWE-1333 [58].
We highlight two well-documented service outages caused by ReDoS, together with the real-world regular expression that triggered the worst-case behavior in the deployed engines.111These two examples are written in the syntax of the corresponding real-world regex engines, not in the formal syntax introduced below. For example, \s is a whitespace character class and \u200c is the Unicode escape for U+200C. These examples are used only to demonstrate that backtracking engines can already cause quadratic-time ReDoS without backreferences.
According to their reports [78, 43], these outages occurred because the employed regular expression engines relied on backtracking algorithms. Consequently, the above expressions exhibited quadratic-time computation on crafted inputs. It is well known that backtracking-based engines can cause catastrophic exponential backtracking [36, 16, 39], and it is widely believed that avoiding exponential behavior would be sufficient. However, these incidents were surprising in showing that even quadratic-time behavior can lead to a system outage. This is stated explicitly in the post-mortem [78], which we quote verbatim below:
So the Regex engine has to perform a “character belongs to a certain character class” check (plus some additional things) 20,000+19,999+19,998+…+3+2+1 = 199,990,000 [sic] times, and that takes a while. This is not classic catastrophic backtracking (performance is , not exponential, in length), but it was enough.
Motivated by this background, we propose the following criterion:
A regular expression engine is ReDoS-safe if, for each fixed expression, it runs in linear or near-linear time in the length of the input string.
In this paper, we address the following fundamental questions: Can we construct a ReDoS-safe regular expression engine in the above sense? If so, which practical extensions can such an engine still support?
Complexity of REGEX matching problems
The term “regular expression” is used for several different formalisms. In this paper, following classical formal language theory, we use the standard (Kleene) regular expressions, denoted by REGEX.
Definition 1 (Syntax of REGEX).
The syntax of REGEX over an alphabet is given by the grammar:
We give the formal semantics, including the language , in the full version [53]. For REGEX, we consider the following computational problem.
REGEX Matching Problem
Fixed Object: A REGEX .
Input: A string .
Task: Deciding if where is the language of .
From REGEX to REWB
Does the linear-time algorithm for REGEX matching fully resolve ReDoS in practice? The answer is No. This is because most real-world regular expression engines support extensions beyond REGEX. One of the most prominent extensions is backreferences. We use REWB to denote the class of regular expressions with backreferences. Unlike REGEX, REWB allows variables that capture substrings matched by a subexpression and refer back to that captured string later. Backreferences are widely supported in the standard regular expression libraries of major programming languages (e.g., C++, Java, JavaScript, Python, Ruby, Perl, PHP, and OCaml). The syntax of REWB is given as follows.
Definition 2 (Syntax of REWB).
The syntax of REWB is given by the following grammar:
where and is a variable. The expression captures the substring matched by and stores it in , while refers to the content stored in .
As with REGEX, we give the formal semantics of REWB in the full version [53].
We note that REWB is strictly more expressive than REGEX. Consider the expression . Intuitively, the subexpression matches an arbitrary string and binds it to . Then, matches the captured substring stored in . Hence, defines the non-regular language .
This paper focuses on the following problem.
REWB Matching Problem
Fixed Object: A REWB .
Input: A string .
Task: Deciding if .
This raises a natural question: Is it possible to design a ReDoS-safe engine for the REWB matching problem? Unfortunately, No. If we view as part of the input and parameterize the problem by , the number of variable occurrences in , then the REWB matching problem is W[1]-hard [79, 33]. In particular, under the standard assumption , there is no uniform algorithm running in for all inputs . However, this worst-case hardness is too pessimistic for practice. In practice, many real-world REWB expressions use backreferences in restricted ways. To identify which REWB subclasses are ReDoS-safe and which remain vulnerable, we need a fine-grained analysis of the REWB matching problem.
Classification of REWB
We write -REWB to denote the set of REWBs that have at most distinct variables. We say that an expression is -use if, for every input string and for all computations of on , the total number of executed backreferences (i.e., executed occurrences of ) is at most . Intuitively, a computation is one possible run of on ; different runs may arise from different choices at the union and Kleene-star subexpressions of , and may therefore execute different numbers of backreferences. If no such finite exists, we call -use. We illustrate these notions with the following examples:
-
is a -use -REWB because there is only one variable , which is referenced once.
-
is a -use -REWB because there is only one variable , which is referenced twice.
-
is also a -use -REWB that reuses the single variable .
-
is an -use -REWB, as can be referenced an unbounded number of times.
-
is a -use -REWB because it contains two variables and , which are referenced a total of two times.
We allow both capture groups and backreferences to appear inside capture groups. That is, the body of a capture group may contain subexpressions of the form or , where may be equal to . For example, (“doubling the content of ”) and (“wrapping with s”) are well-formed.
Known algorithmic results for REWB matching
The current best-known algorithm for -REWB matching runs in time [25, §IX. C][70] based on standard dynamic programming. Recently, Nogami and Terauchi studied the ABCBD problem, a subclass of the -REWB matching problem, and gave an -time algorithm [70, Thm. 5]. Although their result improved upon the standard DP-based -time algorithm, it is not ReDoS-safe due to its quadratic dependence on .
1.1 Our Contribution
We summarize our main hardness and algorithmic results.
1.1.1 Hardness Results for the REWB Matching Problem
Theorem 3.
When the expression is part of the input, the REWB matching problem is -hard parameterized by the expression size .
Assuming that Triangle Detection on an -edge graph does not admit an -time algorithm [1, Conjecture 3], we derive a conditional lower bound even for the highly restricted class, -use 2-REWB.
Theorem 4.
Assuming the no-almost-linear-time hypothesis for Triangle Detection, there exists a fixed -use -REWB expression such that the matching problem for cannot be solved in time for some constant .
Under the -Orthogonal Vectors hypothesis (-OV) [84], which is a weaker assumption than the strong exponential time hypothesis (SETH), we have the following result.
Theorem 5.
Assuming the -OV hypothesis, for each fixed integer , there exists a fixed -use -REWB expression such that the matching problem for cannot be solved in time for any .
Very recently and independently of our work, Nogami and Terauchi [71, Theorem 1] proved the following lower bound: assuming the -OV hypothesis, no algorithm solves the -REWB matching problem in time. Our result strengthens theirs in the following two ways: (1) our hardness holds for general ; and (2) as our hardness holds for a fixed expression , it rules out any speedup gained by allowing arbitrary dependence on .
1.1.2 Algorithmic Results
We have shown that the REWB matching problem remains hard even for -use -REWBs (Theorem 4) and for (-use) -REWBs (Theorem 5 with ) when seeking a near-linear-time algorithm. This naturally raises the question: What is the complexity of -use REWB matching? Our main algorithmic result is a near-linear-time algorithm for the following special case:
ABCBD Problem
Fixed Objects: REGEXes , , , and .
Input: A string .
Task: Deciding if we can decompose into so that , , , and . Equivalently, decide whether .
At first glance, this syntax may appear highly restricted. However, the ABCBD problem captures the general case of -use REWB in the following sense:
Theorem 6.
For any 1-use REWB , there exists an equivalent REWB of the following form:
where , , , , are REGEXes.
We can construct the above representation in time.
Furthermore, the following holds for their size:
The main result of this paper is as follows.
Theorem 7.
The ABCBD problem admits an -time algorithm. The hidden constant is .
This significantly improves the -time algorithm of Nogami and Terauchi [70]. Our algorithm is highly nontrivial; for a more detailed overview, see Section 3. Note that our algorithm can also be viewed as a near-linear-time fixed-parameter algorithm for the ABCBD matching problem, parameterized by the (combined) size of REGEXes , , , and . Combining Theorems 6 and 7, we obtain the following.
Theorem 8.
The -use REWB matching problem admits an -time algorithm. The hidden constant is .
Note that the hidden constant is larger than in Theorem 7 because Theorem 6 may yield expressions of quadratic length.
Remark: Uniformity.
The algorithms in Theorems 7 and 8 are uniform. Namely, they take the relevant expressions ( in Theorem 7, and in Theorem 8) together with the input string , perform all preprocessing depending on these expressions, and then run the main procedures. The fixed-object formulation only emphasizes the dependence on ; no non-uniform advice depending on the fixed expressions is assumed.
As a key subroutine for solving the ABCBD problem, we have also developed an efficient algorithm for the following problem.
Problem
Fixed Objects: An integer and REGEXes , , and .
Input: A string .
Task: Deciding if we can decompose into so that , , and . Equivalently, decide whether .
Our theorem for this problem is the following.
Theorem 9.
The problem admits an -time algorithm. The hidden constant is , where . Alternatively, at the cost of an additional factor (i.e., time ), we can achieve a polynomial dependence on .
1.1.3 Open Problems
Several problems remain to be investigated. The first direction is to specify classes of REWB that admit near-linear-time algorithms. We have shown that -use REWBs admit a near-linear-time algorithm, whereas -use -REWBs and -use -REWBs are unlikely to admit such algorithms. However, the matching complexity of -use -REWB for any constant remains open.
The second direction is to improve our algorithm for the problem. The most direct question is whether we can eliminate the remaining logarithmic factor and obtain a truly linear-time algorithm: reducing to . Moreover, when REWB is given as input, our algorithm has an exponential dependency on the expression length . Specifically, it is open whether it is possible to reduce the dependence on to polynomial while preserving near-linear dependence on . Note that, if we allow quadratic dependence on , the algorithm of Nogami and Terauchi [70] already achieves -time. Furthermore, as we describe in Section 3, our algorithm consists of many building blocks and is therefore quite complex. Simplifying it is a meaningful task both for advancing theoretical understanding and for improving practical implementability.
The third direction is to broaden the scope. Real-world regular expression engines support many features beyond backreferences, such as lookaround [36, 41], greedy and lazy Kleene stars [36, 42], and atomic grouping [36, 40]. Therefore, investigating the complexity of matching regular expressions augmented with such features is important in practice. We believe that these problems are also theoretically interesting, in the same way that the REWB matching problem admits deep algorithmic study, as demonstrated in this paper.
1.1.4 Organization
The rest of the paper is organized as follows. Section 2 reviews related work on ReDoS and on hardness and algorithmic results for REGEX, REWB, and related matching problems. Section 3 gives a technical overview of our main algorithmic result, Theorem 7. Section 4 presents our hardness results: W[2]-hardness from -Dominating Set, a conditional lower bound for 2-use 2-REWBs under the Triangle Detection hypothesis, and a lower bound for -REWBs under the -OV hypothesis, and hence under SETH. The remaining proofs and complete algorithmic details are deferred to the full version [53].
2 Related Work
2.1 ReDoS
Regular Expression Denial of Service (ReDoS) has been recognized as an important instance of algorithmic complexity attacks [21] since at least 2003 [20]. Outages at Stack Overflow (2016) [78] and Cloudflare (2019) [43] are representative examples, and notably, both incidents were triggered by quadratic behavior of regular expression engines, highlighting that even polynomial complexity can result in severe real-world failures. ReDoS is a common type of DoS attack that is officially cataloged as CWE-1333: Inefficient Regular Expression Complexity [58]. Vulnerabilities continue to be discovered and reported in practice; high-risk examples include [61, 62, 63, 64, 65] from 2021 to 2024. In 2025, notable entries in the CVE (Common Vulnerabilities and Exposures, which maintains a public record of disclosed security issues) include [66, 67, 68].
At its core, ReDoS arises from backtracking-based regex engines, which may exhibit catastrophic (possibly exponential) backtracking [39]. This behavior has long been known to automata theorists, and an influential book [36] helped disseminate the problem more widely to practitioners. For classical REGEX matching, Cox [16, 17] recommended that practitioners prefer Thompson NFA-based implementations over backtracking-based engines, as the former run in time. In contrast, it is unlikely that REWB matching admits such a “silver bullet” solution like the Thompson construction, as this problem is NP-hard in general [2, 9]. This has motivated complexity-theoretic research into the REWB matching problem, including the identification of tractable classes [35, 70, 75].
As an example of ReDoS involving expressions with backreferences, we focus on CVE-2017-16114 [59] and CVE-2019-25103 [60]. Both cases are triggered by an expression that can be abstracted as , on which backtracking-based engines take cubic time in the worst case. In CVE-2019-25103, the corresponding patch [13] rewrote to ; it modified only the “REGEX-part” without touching the “backreference-part”. Consequently, although the ReDoS vulnerability is mitigated, potential vulnerabilities remain, as even the patched version exhibits quadratic time complexity; this issue seems to be an inevitable overhead of backtracking-based engines, as they try all possible prefixes that the variable captures. In CVE-2017-16114, the corresponding patch [82] rewrote to . Although admits linear-time matching, it alters the accepting language: for example, and accept but does not. In contrast, the original expression falls within our fragment; thus, it can be evaluated in near-linear time by our algorithm without modifying the semantics.
2.2 Hardness of Regular Language Matching Problems
On REGEX
While Thompson’s construction [80] solves REGEX matching in time, Backurs and Indyk [7, Thm.3] proved that time is unachievable under SETH.
Recently, Bringmann et al. introduced the NFA Acceptance Hypothesis [12]: intuitively, for a dense NFA , the membership problem cannot be solved in time for any . Bille and Gørtz [10] introduced a parameter called density (the total number of active states during the simulation on the input ) and proved that matching for sparse NFAs (or REGEXes) also cannot be solved in time under SETH. These results suggest that improving upon the textbook -time algorithm for REGEX matching is unlikely at present.
On REWB
The REWB matching problem is known to be NP-complete [2, Thm 6.2] when the REWB expression is a part of the input, even over a unary alphabet [9]. Moreover, when parameterized by the number of variables , the -REWB matching problem is W[1]-hard [33, Thm. 1]. In fact, W[1]-hardness already holds for a more restricted fragment of REWB called pattern languages [33, Thm. 1][79, Thm. 1]. We briefly recall pattern languages below to relate them to REWB and summarize known algorithmic results.
2.3 Algorithms for Regular Expression Matching Problems
On REWB
The current best-known algorithm for the -REWB matching problem is based on dynamic programming and runs in time [25, §IX. C]. Applying this algorithm to the ABCBD problem yields an -time algorithm. Nogami and Terauchi gave an -time algorithm, and thereby improved the dependence on from cubic to quadratic. As noted earlier, our Theorem 7 further improves the dependence on to near-linear.
Freydenberger and Schmid [35] considered the matching problem for the class of deterministic REWBs, which is a subclass of REWBs that can deterministically match strings when reading from the left. They gave an -time algorithm for -REWB. Schmid [75] extended this result to the wider class of memory-deterministic REWBs and gave an -time algorithm for some constant . They also refined the time complexity of the REWB matching problem to for the cases of small , where denotes the active variable degree, which represents the maximum number of variables that are “active” at the same time.
Pattern Language and Word Equation
A pattern language is a class of languages generated by patterns, that is, strings that may also contain variables that can be matched to strings. For example, the pattern over with a variable generates the language . This concept was introduced by Angluin in the late 1970s in the context of learning theory and has since been studied extensively [5, 6, 57, 77].
Pattern languages can be seen as a very restricted subclass of REWB. Specifically, a pattern language can be expressed as a REWB that: (1) uses a capture group for the first occurrence of each variable , (2) uses a backreference for all subsequent occurrences, and (3) only allows concatenation as the outermost operator (no union or Kleene star over captures/backreferences). For example, the above pattern equals the REWB .
The matching problem of pattern languages is NP-complete [5, 6, 29, 51] even for the case with alphabet size , each variable occurs at most twice, and each variable can be replaced with a string of length in or [32]. Ibarra et al. gave an -time algorithm for the membership problem of -variable pattern languages, where is the given pattern expression [47]. In particular, it runs in linear time when . Fernau et al. [30] gave algorithms for several classes of pattern languages with good properties. Particularly, they showed that for the case of non-crossing (i.e., scopes of different variables do not overlap) pattern languages, the matching problem admits an -time algorithm, where is the number of one-variable blocks occurring in a given pattern [30, Thm 8][31, Thm 4.16]. Observe that our problem generalizes the case by allowing arbitrary REGEXes for , , and .
Given two pattern languages (possibly sharing variables), the word equation problem asks whether there is a string that matches both of them. The case that one of the languages contains no variables is equal to the pattern language matching problem. In general, the word equation problem is known to be in PSPACE [74]. For the -variable case, Dąbrowski and Plandowski [23] gave an -time algorithm where is the total size of given patterns and is the total number of variable occurrences. Later, in the RAM-model setting, Jeż [48] gave an -time algorithm using the recompression technique introduced by Jeż [49]. Dąbrowski and Plandowski [24] gave an -time algorithm for the -variable case. In contrast, the problem becomes significantly harder for variables; even for the -variable case, it is not even known whether the problem is in NP [50]. Schulz [76] considered a variant of the word equation problem that each variable has a REGEX constraint. They proved this variant is decidable; it was later proved to be PSPACE-complete by Diekert et al. [26].
On REGEX with Lookaround
Lookaround is one of the features that real-world regular expression engines support, which checks whether a specified pattern exists around the current position, without consuming characters. It is folklore that the language class of REGEX equipped with lookaround is regular222We can convert it to a two-way alternating finite automaton (2AFA) [14], whose language class is regular [54].; thus, it admits time matching by Thompson’s construction when we only consider the dependence on . Therefore, research concerns the dependence on the expression length , and particularly, focuses on time algorithms.
Mamouras and Chattopadhyay [56] provided an time membership algorithm. Chattopadhyay et al. [15] mechanized an algorithm of the same complexity based on [56] and verified its correctness using the proof assistant Rocq (formerly known as Coq). Barrière and Pit-Claudel [8] provided a matching algorithm of the same complexity that is faithful to JavaScript REGEX matching semantics. Fujinami and Hasuo [37] provided a matching algorithm of the same complexity, which also supports atomic grouping, which is a practical extension that does not enlarge the language expressiveness [36, 40]. Uezato [81] proved that the membership problem of REWB equipped with lookahead (lookaround that only examines after the current position) is PSPACE-complete.
Gapped Patterns
Another well-studied regular-language formalism, motivated by practical pattern matching applications (rather than REWB), is that of gapped patterns. A typical gapped pattern has the form
where each is a fixed string and is the set of strings whose lengths lie between and . Thus, every gapped pattern denotes a regular language and can be expressed as a classical REGEX. Matching such patterns, including dictionary variants in which a finite set of gapped patterns is matched against a text, has been studied extensively; see, e.g., [69, 34, 11, 44, 46] and the survey [55]. Particularly relevant from a fine-grained perspective is the work of Amir et al. [4] on dictionary matching with one gap. In the uniformly bounded case, a dictionary consists of patterns of the form with common bounds . The task is to report their occurrences in an input text . Under the 3SUM conjecture [38, 72, 52], for suitable dictionaries, they proved a lower bound of where is the output size [4, Thm. 5 and Table 2]. Complementing this, they also gave an online reporting algorithm whose running time depends on structural parameters of dictionaries, in particular the degeneracy of the associated bipartite graph [4, Thm. 9].
3 Technical Overview of Theorem 7
We provide an overview of our algorithm for Theorem 7, which finds a decomposition with for . The following figure, Figure 1, summarizes the overall structure.
Remark.
The complete proofs and the full algorithmic details are given in the full version [53]. In this technical overview, we use the subscript to refer to section numbers in the full version: for instance, means Section 10 of the full version. Thus, unless explicitly stated otherwise, section references with this subscript refer to the full version rather than to the present conference version.
To streamline our algorithm, we first normalize the input and expressions so that and the alphabet is binary in Section 4F. Then, we can assume . In Section 5F, we reduce the ABCBD problem to two subproblems: the XYYZ problem (Section 6F) and the branching ABCBD problem (Sections 7F–12F). In the former problem, we consider the case , i.e., . In the latter problem, we consider the case where two suffixes and satisfy a branching condition; that is, their first letters are distinct. To show that this decomposition covers all cases, we rely on the closure properties of REGEX and the equivalence with nondeterministic finite automata (NFAs), as detailed in Section 5.2F.
The key structure of the former (XYYZ) problem (our problem with , Section 6F) is that, since , two occurrences of appear consecutively in as . We crucially exploit the periodicity of induced by this immediate repetition . We use Crochemore’s maximal local power enumeration [19, Sec. 9.2][18] (Section 6.1F), in combination with the periodic properties of REGEX (Section 6.3F). This part also yields Theorem 9.
To solve the latter (branching ABCBD) problem (Sections 7F–12F), we work with the suffix tree of , , or simply (see Section 2F for the definition). Each leaf has an index of and corresponds to the suffix (.) Each inner node represents the substring given by the path-label from the root. For each , we maintain the set of all indices of leaves in the subtree rooted at . We note that our suffix tree is binary because .
The key property of the problem is the branching condition. It means that the two paths from the root to and to branch at the node corresponding to (as illustrated in the figure below). Using this property, it suffices to consider the following task:
: For each node , find a pair of suffixes branching at that induces a feasible decomposition.
We can illustrate our task as follows using a suffix tree:
Let , where is a child of maximizing the size , and define . We employ a classical small-to-large (or heavy-light decomposition) strategy: for each we determine whether there exists such that the pair induces a feasible decomposition. Since , the remaining task of is to find such an index in time for each . We then split the task into the two cases Right- and Left- in Section 7F.
In Right-, for each , we consider the case : i.e., the shorter suffix starts at . Namely, we search for such that , illustrated as follows:
In Left-, we consider the case where is the starting position of the longer suffix . We search for such that , illustrated as follows:
To handle both cases, we use the same high-level approach: traverse bottom-up and maintain the sets using suitable data structures. Since the concrete algorithms and data structures differ between the two cases, we present them separately.
Right- Case (Sections 8F and 9F)
Let be a node of and be the string represented by . Let , where corresponds to . We assume and because otherwise there is no feasible solution. Our task is to find an index such that corresponds to . To treat the constraint , we manage using a data structure that answers whether there is an index with such that . We call this structure RightEnumerator (Section 9F).
However, this is not yet sufficient, as we must also enforce the constraint . Crucially, whether a fixed index satisfies this constraint depends on the current node . This is because the substring corresponding to begins at , and this starting position shifts as the length varies with . Consequently, we must handle the constraints for both and simultaneously. To address this, we partition into subsets such that all indices in the same subset share the same validity regarding (Section 8F). Leveraging the fact that REGEX admits a finite transition monoid (see Section 2F for definition), we can ensure that we need to maintain only a constant number of subsets. By maintaining a separate instance of RightEnumerator for each subset and merging them using a disjoint set union data structure, we can resolve the issue and handle this case.
A simple way of constructing RightEnumerator is to use a segment tree, where each node is equipped with the set of elements of transition monoids (Section 9F). This yields an -time algorithm. In our algorithm, employing a factorization forest (see Section 2F for definition), we further eliminate one logarithmic factor and achieve time.
Left- Case (Sections 10F–12F)
Let be a node of and be the substring represented by . Let , where corresponds to . We assume and because otherwise there is no feasible solution. Our task is to find an index with such that corresponds to . Moreover, we can handle the constraint for simply by managing only indices with (recall that, unlike the Right- case, it is independent of ). The remaining task is to find satisfying and . We treat it as a data structure problem (Section 10.2F). We note that RightEnumerator is insufficient for our purpose, since the constraint depends on , which varies with the current node .
To address the problem, we consider the following two subcases separately:
In the near- case (Section 12F), we derive a periodicity for because, for any two indices in the near- case, the substrings and overlap. With the periodicity inherent to REGEX, we can efficiently solve the near- case in time. On the other hand, in the far- case, the index is “sufficiently far” from . Technically, the condition implies that the distance between and is at least ; we use this margin for the design of our data structure.
To solve the far- case, we adopt the following strategy. We first build a data structure AuxiliaryEnumerator (Section 11F), which maintains intervals as the item while ensuring . Given , it answers whether there is an interval such that and . For the condition , it suffices to ensure holds at any moment. The issue is that as we traverse , the node changes (thus, decreases), so the condition will be violated. To resolve this issue, when the violation occurs (the margin becomes at least ), we “re-insert” the new interval to the data structure, where . The total overhead cost is time because “re-insertion” happens only after is halved; this is ensured by the “far-” condition.
The remaining task is to construct AuxiliaryEnumerator (Section 11F). This is similar to RightEnumerator, but requires additional mechanisms to quickly answer queries of , which depends on the current (and thus, ). We adopt a lazy update strategy for this purpose. As in RightEnumerator, using the segment tree leads to the time complexity , which can be accelerated to using the factorization forest.
4 Hardness
We show our three hardness results in this section:
- 1.
- 2.
- 3.
Remark.
Due to space limitations, we omit proofs in this conference version. The full version contains the complete proofs of all statements in this section.
In Section 4.1 and 4.2, we use the following notation. Let be an undirected graph without self-loops where is a set of vertices and is a set of edges. For our constructions, we assume that each vertex is uniquely encoded as a binary string of length ; that is, , where, for a REWB , we write for one or more repetitions of .
For readability, in this Section 4, we sometimes write instead of .
4.1 W[2]-hardness for REWB: Reduction from -Dominating Set Problem
We prove Theorem 3 by reduction from the following -dominating set problem ().
: -Dominating Set Problem
Input: An undirected graph and an integer .
Task: Deciding if there is a -dominating set: i.e., a subset of size exactly such that:
We note that, since is undirected, . It is known that this problem is -complete [27] when parameterized by . Furthermore, the following is known.
Lemma 10 ([73][22, Thm 14.42]).
Assuming SETH, there is no algorithm running in time solving for any .
Our main task is to provide the following reduction from to -REWB matching problem.
Lemma 11 (Reduction from to -REWB Matching Problem).
Let be an integer. In time , we can construct a -REWB of length satisfying the following.
Let be an undirected graph. There exists a string such that the following holds:
In particular, we can construct the string in time with where is the number of vertices and is the number of edges.
Remark.
We refer the reader to the full version for the proof of this reduction lemma.
From this lemma, we obtain the following W[2]-hardness result. See 3
Proof.
We give an FPT-reduction from .
Given an instance , we output the matching instance , where is constructed in time and is constructed in time as in Lemma 11, such that iff has a -dominating set of size exactly .
Moreover, the parameter of the output instance satisfies . Hence, this is an FPT-reduction, and the claim follows since is W[2]-hard. We note that this result is stronger than W[2]-hardness parameterized by the number of variables , since the number of variables is at most the expression length .
4.2 Hardness for -use -REWB: Reduction from Triangle Detection Problem
We prove Theorem 4 by reduction from the following triangle detection problem.
Triangle Detection Problem
Input: An undirected graph with vertices and edges.
Task: Deciding whether contains a triangle, that is, whether there is a set of three distinct vertices with .
The following is conjectured about the triangle detection problem.
Hypothesis (No-Almost-Linear-Time Hypothesis [1, Conjecture 3]).
There is a constant , such that in the Word RAM model with words of bits, any algorithm requires time in expectation to detect whether a graph with edges contains a triangle.
In this section, our main task is to give the following reduction from the triangle detection problem to the -use -REWB matching problem.
Lemma 12 (Reduction from Triangle Detection Problem to -use -REWB Matching Problem).
There exists a fixed -use -REWB expression that solves the triangle detection problem in the following sense:
Let be an undirected graph with vertices and edges. There exists a string such that the following holds:
In particular, we can construct the string in time, and the size of is .
Remark.
We refer the reader to the full version for the proof of this reduction lemma.
We can show our hardness result from Lemma 12. While the proof follows a standard reduction argument, we provide the details below for completeness.
Theorem 4. [Restated, see original statement.]
Assuming the no-almost-linear-time hypothesis for Triangle Detection, there exists a fixed -use -REWB expression such that the matching problem for cannot be solved in time for some constant .
Proof.
Assume the No-Almost-Linear-Time Hypothesis holds. Let be the constant specified in the hypothesis; that is, any algorithm requires time .
Let be the fixed -use -REWB expression from Lemma 12. For every graph with vertices and edges, we can construct such that .
Set . It suffices to rule out algorithms running in time , since any -time algorithm also runs in time . Suppose, for contradiction, that there is an algorithm for running in time .
We construct a triangle detection algorithm as follows: Given , remove isolated vertices so that , construct , and run the matching algorithm on . The construction of takes time and yields . Since , we have . Running on takes the following time :
Since , the total running time of is:
Substituting , we get:
For sufficiently large , . Thus, solves the triangle detection problem strictly faster than the hypothesized lower bound , which is a contradiction. Thus, no -time algorithm for exists. In particular, no -time algorithm exists. Taking proves the theorem.
4.3 Hardness from -Orthogonal Vectors Problem Hypothesis
We now prove our -time hardness for the -REWB matching problem, where denotes the length of input strings, under the -orthogonal vectors (-OV) hypothesis [28, 84], and hence under SETH. To use for the -OV and its hypothesis, we use “” to denote the number of variables of REWB in this section.
Let be -dimensional 0-1 vectors over the ring . The inner-product is defined as follows:
These vectors are -orthogonal if . In our construction, we use the following equivalent condition: .
We now consider the -OV and the -OV Hypothesis.
Problem
Input: sets where each set has size .
Task: Deciding if the following holds:
Hypothesis (-OV Hypothesis [28, Hypothesis 2],[84, Hypothesis 4]).
Let be an integer. For any and every dimension function (e.g., ), cannot be solved in time.
Remark.
It is known that the -OV hypothesis is weaker than SETH; indeed, SETH implies the -OV hypothesis [84, Theorem 3.1] [28, 83].
We provide an efficient reduction from problem to -REWB matching problem.
Lemma 13.
Let be an integer.
There exists a (fixed) -REWB that solves in the following sense:
Let be an integer and be an instance of -OV with .
There is a string such that
In particular, we can construct in time.
Before providing the proof of this lemma (shown in Section 4.3.1), we here prove Theorem 5 using this lemma. While the proof follows a standard reduction argument, we provide the details below for completeness.
Theorem (Reformulation of Theorem 5).
The -REWB matching problem cannot be solved in time for any under the -OV hypothesis.
Proof.
We proceed by contradiction. Suppose there exists an algorithm solving the problem in time for some constant . We construct an efficient algorithm to solve as follows:
-
1.
Given an instance of consisting of sets of vectors in , we first transform it into a string by our reduction. By the assumption, this reduction takes time, and for some constant depending on .
-
2.
Next, we run the algorithm on . The running time is
Fix the dimension function . Since holds, the -OV Hypothesis (with ) applies also to .
By Step 2 we obtain a algorithm with running time:
Since , we have . Thus for any and sufficiently large ,
Choose . Then
contradicting the -OV Hypothesis with .
4.3.1 Proof of Lemma 13
To explain our idea, we first give a reduction from to -REWB matching problem. The reduction can be easily extended to a reduction from to -REWB.
Lemma 14 (Reduction for ).
There exists a (fixed) -REWB that solves in the following sense: Let be an integer and be an instance of -OV with . There is a string such that
In particular, we can construct in time.
Proof.
We note that the proof presented here can be viewed as the REWB-version of a similar result and construction for 1-turn bounded-height () pushdown automata [45, Theorem 4].
Let and . We set and define the following string , which serves as the arena for our construction:
where means the reversed version of : i.e., . It should be noted that .
A key idea of our reduction is to represent a pair of vectors with by a single substring of . A substring of represents if the following holds:
More formally, let be the factor (substring) of that starts right after the occurrence of and ends right before the occurrence of . It is explicitly given by:
If , the left part is empty; if , the right part is empty.
For example, if and , then our string takes the following form:
In this setting, the substring represents because it starts right after and ends right before in . Below we write to denote for this example.
We define the following building block expression and where
-
we use by applying it to a copy of to nondeterministically select and represent vectors from and from ; and
-
we use (resp. ) by applying it to a copy of to check (resp. ) for each index .
We first define our expression as follows:
where is the REGEX. We note that cannot consume the symbols and .
We apply to to nondeterministically select vectors from and from . For our example and , applying to can generate the following match, in which and are selected:
Another run can select and as follows:
By the above observation, the following is clear.
Proposition 15.
Applying to , it completely consumes and saves a substring into the variable , which represents for some . Moreover, any pair can be captured and represented via by applying to .
Next we define our expressions and as follows:
where .
The former requires and the latter requires for some index . For example, applying to another copy of under , it works as follows:
This application also updates as follows:
Since one application of and extends by one symbol on each side,
we can check by repeatedly applying the expression .
For example, applying to another copy of under the updated ,
it checks if and updates as follows:
By the above observation, the following is clear.
Proposition 16.
Assume the content of represents and for some . Then, applying to , the following holds: if the application succeeds, then and is updated to represent and (when ).
In summary, we employ the following gadgets:
It should be noted that the expression does not depend on the instance and ; this can be used for any instances.
By the above argument, it is clear that iff there are orthogonal vectors in and . We note that because , and can be constructed in time.
We can generalize the above reduction to one from to -REWB.
Lemma 13. [Restated, see original statement.]
Let be an integer.
There exists a (fixed) -REWB that solves in the following sense:
Let be an integer and be an instance of -OV with .
There is a string such that
In particular, we can construct in time.
Proof.
We extend the construction for Lemma 14 to the case . We represent vectors using variables . We assume the following representation:
We change the definition of as follows:
where
For example, if ,
We use the variable () to represent with . For example, if , we use and as follows:
To accommodate multiple variables, we below modify , , and in Lemma 14 (the case ).
We first define to nondeterministically select vectors from and bind them into as follows:
As with in Lemma 14, the following holds for .
Proposition 17.
Applying to , it completely consumes and saves substrings to the variables where each represents for some . Moreover, for each , any pair can be captured and represented via by applying to .
We next define to check or () as follows:
where
Proposition 18.
Assume that, for an index , every represents and for . If the application of to succeeds and consumes , then either or holds. Moreover, every is updated to represent and (when ).
Conversely, if or holds, then applying to must succeed.
Using , we further define to check the -orthogonality condition:
We observe that applying to succeeds iff when each represents and . Then, we finally define and as follows:
From the above properties, we observe the following, which completes our proof:
References
- [1] Amir Abboud and Virginia Vassilevska Williams. Popular conjectures imply strong lower bounds for dynamic problems. In FOCS 2014, pages 434–443. IEEE Computer Society, 2014. doi:10.1109/FOCS.2014.53.
- [2] Alfred V. Aho. Algorithms for finding patterns in strings. In Jan van Leeuwen, editor, Handbook of Theoretical Computer Science, Volume A: Algorithms and Complexity, pages 255–300. MIT Press, 1990. doi:10.1016/B978-0-444-88071-0.50010-2.
- [3] Alfred V. Aho, Ravi Sethi, and Jeffrey D. Ullman. Compilers: Principles, Techniques, and Tools. Addison-Wesley, 1986. URL: https://www.worldcat.org/oclc/12285707.
- [4] Amihood Amir, Tsvi Kopelowitz, Avivit Levy, Seth Pettie, Ely Porat, and B. Riva Shalom. Mind the gap! online dictionary matching with one gap. Algorithmica, 81:2123–2157, 2019. doi:10.1007/s00453-018-0526-2.
- [5] Dana Angluin. Finding patterns common to a set of strings (extended abstract). In STOC 1979, pages 130–141. ACM, 1979. doi:10.1145/800135.804406.
- [6] Dana Angluin. Finding patterns common to a set of strings. JCSS, 21(1):46–62, 1980. doi:10.1016/0022-0000(80)90041-0.
- [7] Arturs Backurs and Piotr Indyk. Which Regular Expression Patterns Are Hard to Match? In FOCS 2016, pages 457–466. IEEE Computer Society, 2016. doi:10.1109/FOCS.2016.56.
- [8] Aurèle Barrière and Clément Pit-Claudel. Linear matching of JavaScript regular expressions. Proc. ACM Program. Lang., 8(PLDI), June 2024. doi:10.1145/3656431.
- [9] Martin Berglund and Brink van der Merwe. Re-examining regular expressions with backreferences. Theor. Comput. Sci., 940(Part):66–80, 2023. doi:10.1016/j.tcs.2022.10.041.
- [10] Philip Bille and Inge Li Gørtz. Sparse regular expression matching. In SODA 2024, pages 3354–3375. SIAM, 2024. doi:10.1137/1.9781611977912.120.
- [11] Philip Bille, Inge Li Gørtz, Hjalte Wedel Vildhøj, and David Kofoed Wind. String matching with variable length gaps. Theor. Comput. Sci., 443:25–34, 2012. doi:10.1016/j.tcs.2012.03.029.
- [12] Karl Bringmann, Allan Grønlund, Marvin Künnemann, and Kasper Green Larsen. The NFA Acceptance Hypothesis: Non-Combinatorial and Dynamic Lower Bounds. In ITCS 2024, volume 287 of LIPIcs, pages 22:1–22:25. Schloss Dagstuhl, 2024. doi:10.4230/LIPIcs.ITCS.2024.22.
- [13] Aria Buckles. simple-markdown: inlinecode: Fix ReDoS & improve escape semantics (commit 89797fe). GitHub commit, 2019. URL: https://github.com/ariabuckles/simple-markdown/commit/89797fe.
- [14] Ashok K. Chandra, Dexter C. Kozen, and Larry J. Stockmeyer. Alternation. J. ACM, 28(1):114–133, January 1981. doi:10.1145/322234.322243.
- [15] Agnishom Chattopadhyay, Angela W. Li, and Konstantinos Mamouras. Verified and efficient matching of regular expressions with lookaround. In CPP 2025, pages 198–213. ACM, 2025. doi:10.1145/3703595.3705884.
- [16] Russ Cox. Regular expression matching can be simple and fast. https://swtch.com/˜rsc/regexp/regexp1.html, January 2007.
- [17] Russ Cox. Regular expression matching in the wild. https://swtch.com/~rsc/regexp/regexp3.html, March 2010.
- [18] Max Crochemore. An optimal algorithm for computing the repetitions in a word. Inf. Process. Lett., 12(5):244–250, 1981. doi:10.1016/0020-0190(81)90024-7.
- [19] Maxime Crochemore, Christophe Hancart, and Thierry Lecroq. Algorithms on Strings. Cambridge University Press, 2007. doi:10.1017/CBO9780511546853.
- [20] Scott A. Crosby. Denial of service through regular expressions. Presentation at the 12th USENIX Security Symposium, 2003. URL: https://www.usenix.org/conference/12th-usenix-security-symposium/denial-service-through-regular-expressions.
- [21] Scott A. Crosby and Dan S. Wallach. Denial of service via algorithmic complexity attacks. In USENIX Security 03. USENIX Association, 2003. URL: https://www.usenix.org/conference/12th-usenix-security-symposium/denial-service-algorithmic-complexity-attacks.
- [22] Marek Cygan, Fedor V. Fomin, Lukasz Kowalik, Daniel Lokshtanov, Dániel Marx, Marcin Pilipczuk, Michal Pilipczuk, and Saket Saurabh. Parameterized Algorithms. Springer, 2015. doi:10.1007/978-3-319-21275-3.
- [23] Robert Dąbrowski and Wojciech Plandowski. On word equations in one variable. Algorithmica, 60(4):819–828, August 2011. doi:10.1007/s00453-009-9375-3.
- [24] Robert Dąbrowski and Wojtek Plandowski. Solving two-variable word equations (extended abstract). In ICALP 2004, volume 3142 of Lecture Notes in Computer Science, pages 408–419. Springer, 2004. doi:10.1007/978-3-540-27836-8_36.
- [25] James C. Davis, Francisco Servant, and Dongyoon Lee. Using selective memoization to defeat regular expression denial of service (ReDoS). In S&P 2021, pages 1–17, 2021. doi:10.1109/SP40001.2021.00032.
- [26] Volker Diekert, Claudio Gutierrez, and Christian Hagenah. The existential theory of equations with rational constraints in free groups is PSPACE-complete. Inf. Comput., 202(2):105–140, 2005. doi:10.1016/j.ic.2005.04.002.
- [27] Rod G. Downey and Michael R. Fellows. Fixed-parameter tractability and completeness i: Basic results. SIAM Journal on Computing, 24(4):873–921, 1995. doi:10.1137/S0097539792228228.
- [28] Lech Duraj, Marvin Künnemann, and Adam Polak. Tight conditional lower bounds for longest common increasing subsequence. Algorithmica, 81(10):3968–3992, 2019. doi:10.1007/S00453-018-0485-7.
- [29] Andrzej Ehrenfeucht and Grzegorz Rozenberg. Finding a homomorphism between two words in NP-complete. Inf. Process. Lett., 9(2):86–88, 1979. doi:10.1016/0020-0190(79)90135-2.
- [30] Henning Fernau, Florin Manea, Robert Mercaş, and Markus L. Schmid. Pattern Matching with Variables: Fast Algorithms and New Hardness Results. In STACS 2015, volume 30 of LIPIcs, pages 302–315. Schloss Dagstuhl, 2015. doi:10.4230/LIPIcs.STACS.2015.302.
- [31] Henning Fernau, Florin Manea, Robert Mercaş, and Markus L. Schmid. Pattern matching with variables: Efficient algorithms and complexity results. ACM Trans. Comput. Theory, 12(1), February 2020. doi:10.1145/3369935.
- [32] Henning Fernau and Markus L. Schmid. Pattern matching with variables: A multivariate complexity analysis. Inf. Comput., 242:287–305, 2015. doi:10.1016/j.ic.2015.03.006.
- [33] Henning Fernau, Markus L. Schmid, and Yngve Villanger. On the parameterised complexity of string morphism problems. Theory of Computing Systems, 59(1):24–51, 2016. doi:10.1007/s00224-015-9635-3.
- [34] Kimmo Fredriksson and Szymon Grabowski. Efficient algorithms for pattern matching with general gaps, character classes, and transposition invariance. Information Retrieval, 11:335–357, 2008. doi:10.1007/s10791-008-9054-z.
- [35] Dominik D. Freydenberger and Markus L. Schmid. Deterministic regular expressions with back-references. J. Comput. Syst. Sci., 105:1–39, 2019. doi:10.1016/j.jcss.2019.04.001.
- [36] Jeffrey Friedl. Mastering Regular Expressions. O’Reilly, 2006. URL: https://www.oreilly.com/library/view/mastering-regular-expressions/0596528124/.
- [37] Hiroya Fujinami and Ichiro Hasuo. Efficient matching with memoization for regexes with look-around and atomic grouping. In ESOP 2024, volume 14577 of Lecture Notes in Computer Science, pages 90–118. Springer, 2024. doi:10.1007/978-3-031-57267-8_4.
- [38] Anka Gajentaan and Mark H. Overmars. On a class of problems in computational geometry. Computational Geometry, 5(3):165–185, 1995. doi:10.1016/0925-7721(95)00022-2.
- [39] Jan Goyvaerts. Runaway Regular Expressions: Catastrophic Backtracking. https://www.regular-expressions.info/catastrophic.html, 2021.
- [40] Jan Goyvaerts. Atomic grouping. https://www.regular-expressions.info/atomic.html, 2025.
- [41] Jan Goyvaerts. Lookahead and Lookbehind Zero-Length Assertions. https://www.regular-expressions.info/lookaround.html, 2025.
- [42] Jan Goyvaerts. Repetition with star and plus. https://www.regular-expressions.info/repeat.html, 2025.
- [43] John Graham-Cumming. Details of the Cloudflare outage on July 2, 2019. Cloudflare Blog. Archived at https://web.archive.org/web/20190712160002/https://blog.cloudflare.com/details-of-the-cloudflare-outage-on-july-2-2019/, July 2019. URL: https://blog.cloudflare.com/details-of-the-cloudflare-outage-on-july-2-2019/.
- [44] Tuukka Haapasalo, Panu Silvasti, Seppo Sippu, and Eljas Soisalon-Soininen. Online dictionary matching with variable-length gaps. In Experimental Algorithms, volume 6630 of Lecture Notes in Computer Science, pages 76–87. Springer, 2011. doi:10.1007/978-3-642-20662-7_7.
- [45] Jakob Cetti Hansen, Adam Husted Kjelstrøm, and Andreas Pavlogiannis. Tight bounds for reachability problems on one-counter and pushdown systems. Inf. Process. Lett., 171:106135, 2021. doi:10.1016/j.ipl.2021.106135.
- [46] Wing-Kai Hon, Tak-Wah Lam, Rahul Shah, Sharma V. Thankachan, Hing-Fung Ting, and Yilin Yang. Dictionary matching with a bounded gap in pattern or in text. Algorithmica, 80:698–713, 2018. doi:10.1007/s00453-017-0288-2.
- [47] Oscar H. Ibarra, Ting-Chuen Pong, and Stephen M. Sohn. A note on parsing pattern languages. Pattern Recognit. Lett., 16(2):179–182, 1995. doi:10.1016/0167-8655(94)00091-G.
- [48] Artur Jeż. One-variable word equations in linear time. Algorithmica, 74(1):1–48, 2016. doi:10.1007/s00453-014-9931-3.
- [49] Artur Jeż. Recompression: A simple and powerful technique for word equations. J. ACM, 63(1), February 2016. doi:10.1145/2743014.
- [50] Artur Jeż. Solving Word Equations (And Other Unification Problems) by Recompression. In CSL 2020, volume 152 of LIPIcs, pages 3:1–3:17. Schloss Dagstuhl, 2020. doi:10.4230/LIPIcs.CSL.2020.3.
- [51] Tao Jiang, Efim Kinber, Arto Salomaa, Kai Salomaa, and Sheng Yu. Pattern languages with and without erasing. International Journal of Computer Mathematics, 50(3–4):147–163, 1994. doi:10.1080/00207169408804252.
- [52] Tsvi Kopelowitz, Seth Pettie, and Ely Porat. Higher lower bounds from the 3SUM conjecture. In SODA 2016, pages 1272–1287. SIAM, 2016. doi:10.1137/1.9781611974331.ch89.
- [53] Soh Kumabe and Yuya Uezato. On the complexity of the matching problem of regular expressions with backreferences, 2026. arXiv:2605.07289.
- [54] Richard E. Ladner, Richard J. Lipton, and Larry J. Stockmeyer. Alternating pushdown and stack automata. SIAM Journal on Computing, 13(1):135–155, 1984. doi:10.1137/0213010.
- [55] Avivit Levy and B. Riva Shalom. A comparative study of dictionary matching with gaps: Limitations, techniques and challenges. Algorithmica, 84:590–638, 2022. doi:10.1007/s00453-021-00851-6.
- [56] Konstantinos Mamouras and Agnishom Chattopadhyay. Efficient matching of regular expressions with lookaround assertions. Proc. ACM Program. Lang., 8(POPL), January 2024. doi:10.1145/3632934.
- [57] Alexandru Mateescu and Arto Salomaa. Aspects of classical language theory. In Grzegorz Rozenberg and Arto Salomaa, editors, Handbook of Formal Languages, Volume 1: Word, Language, Grammar, pages 175–251. Springer, 1997. doi:10.1007/978-3-642-59136-5_4.
- [58] MITRE. CWE-1333: Inefficient Regular Expression Complexity. https://cwe.mitre.org/data/definitions/1333.html, 2021. CWE version 4.17. Page last updated: 2025-04-03.
- [59] National Vulnerability Database (NVD). CVE-2017-16114, 2017. URL: https://nvd.nist.gov/vuln/detail/CVE-2017-16114.
- [60] National Vulnerability Database (NVD). CVE-2019-25103, 2019. URL: https://nvd.nist.gov/vuln/detail/CVE-2019-25103.
- [61] National Vulnerability Database (NVD). CVE-2021-21240. https://nvd.nist.gov/vuln/detail/CVE-2021-21240, 2021. GitHub Advisory: https://github.com/advisories/GHSA-93xj-8mrv-444m.
- [62] National Vulnerability Database (NVD). CVE-2023-39663. https://nvd.nist.gov/vuln/detail/CVE-2023-39663, 2023. GitHub Advisory: {https://github.com/advisories/GHSA-v638-q856-grg8}.
- [63] National Vulnerability Database (NVD). CVE-2023-6159. https://nvd.nist.gov/vuln/detail/cve-2023-6159, 2023. GitLab Security Release: {https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/}.
- [64] National Vulnerability Database (NVD). CVE-2024-26142. https://nvd.nist.gov/vuln/detail/CVE-2024-26142, 2024. GitHub Advisory: https://github.com/advisories/GHSA-jjhx-jhvp-74wq.
- [65] National Vulnerability Database (NVD). CVE-2024-28865. https://nvd.nist.gov/vuln/detail/CVE-2024-28865, 2024. GitHub Advisory: https://github.com/advisories/GHSA-wj85-w4f4-xh8h.
- [66] National Vulnerability Database (NVD). CVE-2025-25200. https://nvd.nist.gov/vuln/detail/CVE-2025-25200, 2025. GitHub Advisory: https://github.com/advisories/GHSA-593f-38f6-jp5m.
- [67] National Vulnerability Database (NVD). CVE-2025-29907. https://nvd.nist.gov/vuln/detail/CVE-2025-29907, 2025. GitHub Advisory: https://github.com/advisories/GHSA-w532-jxjh-hjhj.
- [68] National Vulnerability Database (NVD). CVE-2025-5197. https://nvd.nist.gov/vuln/detail/CVE-2025-5197, 2025. GitHub Advisory: https://github.com/advisories/GHSA-9356-575x-2w9m.
- [69] Gonzalo Navarro and Mathieu Raffinot. Fast and simple character classes and bounded gaps pattern matching, with applications to protein searching. Journal of Computational Biology, 10(6):903–923, 2003. doi:10.1089/106652703322756140.
- [70] Taisei Nogami and Tachio Terauchi. Efficient matching of some fundamental regular expressions with backreferences. In MFCS 2025, volume 345 of LIPIcs, pages 81:1–81:19. Schloss Dagstuhl, 2025. doi:10.4230/LIPIcs.MFCS.2025.81.
- [71] Taisei Nogami and Tachio Terauchi. Hardness of regular expression matching with extensions, 2026. doi:10.48550/arXiv.2601.03020.
- [72] Mihai Pătraşcu. Towards polynomial lower bounds for dynamic problems. In STOC 2010, pages 603–610. ACM, 2010. doi:10.1145/1806689.1806772.
- [73] Mihai Pătraşcu and Ryan Williams. On the possibility of faster SAT algorithms. In SODA 2010, pages 1065–1075. SIAM, 2010. doi:10.1137/1.9781611973075.86.
- [74] Wojciech Plandowski. Satisfiability of word equations with constants is in PSPACE. J. ACM, 51(3):483–496, May 2004. doi:10.1145/990308.990312.
- [75] Markus L. Schmid. Regular expressions with backreferences: Polynomial-time matching techniques. J. Autom. Lang. Comb., 29(2-4):321–357, 2024. doi:10.25596/jalc-2024-321.
- [76] Klaus U. Schulz. Makanin’s algorithm for word equations - two improvements and a generalization. In Word Equations and Related Topics, First International Workshop, IWWERT ’90, volume 572 of Lecture Notes in Computer Science, pages 85–150. Springer, 1990. doi:10.1007/3-540-55124-7_4.
- [77] Takeshi Shinohara. Polynomial time inference of extended regular pattern languages. In RIMS Symposia on Software Science and Engineering, pages 115–127. Springer, 1983. doi:10.1007/3-540-11980-9_19.
- [78] Stack Exchange. Outage Postmortem - July 20, 2016. Stack Exchange Network Status Blog. Archived at https://web.archive.org/web/20180801005940/http://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016, July 2016. URL: http://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016.
- [79] Frank Stephan, Ryo Yoshinaka, and Thomas Zeugmann. On the parameterised complexity of learning patterns. In Computer and Information Sciences II, pages 277–281. Springer, 2012. doi:10.1007/978-1-4471-2155-8_35.
- [80] Ken Thompson. Programming techniques: Regular expression search algorithm. Commun. ACM, 11(6):419–422, June 1968. doi:10.1145/363347.363387.
- [81] Yuya Uezato. Regular Expressions with Backreferences and Lookaheads Capture NLOG. In ICALP 2024, volume 297 of LIPIcs, pages 155:1–155:20. Schloss Dagstuhl, 2024. doi:10.4230/LIPIcs.ICALP.2024.155.
- [82] UziTech. marked: fix inline code regex (commit 3271b8b). GitHub commit, 2018. URL: https://github.com/markedjs/marked/commit/3271b8b.
- [83] Ryan Williams. A new algorithm for optimal 2-constraint satisfaction and its implications. Theor. Comput. Sci., 348(2-3):357–365, 2005. doi:10.1016/j.tcs.2005.09.023.
- [84] Virginia Vassilevska Williams. On some fine-grained questions in algorithms and complexity. In Proceedings of the International Congress of Mathematicians (ICM 2018). WORLD SCIENTIFIC, 2019. doi:10.1142/9789813272880_0188.
