Collected research

Revisiting ReDoS: A Rough Idea of Data Exfiltration by ReDoS and Side-channel Techniques

Takashi Yoneuchi · Speaker Deck · 5 February 2020

Shows that timing out a runaway regular expression turns denial of service into a leak oracle: an injected regexp that backtracks catastrophically only when a proposition about a secret holds encodes one bit into response time. Repeating that with length and character predicates, and binary search over the alphabet, reconstructs the secret.

Record

Researcher

Takashi Yoneuchi

Published by

Speaker Deck

Date

5 February 2020

Format

Slides

Topic

Other

In the archive

• Collected in the 2020 research round

Related sources

• Presentation article

Tags

• algorithmic-complexity
• timing-attack
• side-channel
• injection
• info-leak
• dos
• nodejs
• python
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Takashi Yoneuchi, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.