CVE-2026-77299

The Regexp2 library for Go (prior to version 2.3.0 ) is vulnerable to unbounded memory amplification via a large {m} quantifier on a zero-width subexpression. When the engine matches a pattern like (?:){50000000}, it executes an empty loop body, pushing two integers onto the backtracking stack fo...