CVE-2022-24713: Denial of Service in Rust regex via crafted patterns

CVE-2022-24713 is a vulnerability in the Rust regex crate affecting denial of service (DoS) security handling. The regex library implements built-in mitigations to protect services from DoS attacks caused by untrusted regexes or unverified input. These protections are part of the crate's security guarantee, but a flaw in parsing mechanisms allows specially crafted patterns to completely bypass these defenses, causing service outages.

The vulnerability has a CVSS severity score of 7.5, classified as High. It affects all versions of the regex crate up to and including 1.5.4. The fix is available starting from version 1.5.5, released in March 2022 immediately after public disclosure on NVD. Current signals show that the research community continues to monitor and analyze the vulnerability behavior, as evidenced by recent GitHub repositories maintaining offline models of the vulnerable version's compilation accounting.

For defenders, immediate action is to upgrade the regex crate to version 1.5.5 or later. It is recommended to verify all project dependencies that include the crate, both direct and transitive. According to official documentation, attempting to block regexes 'known as problematic' is not recommended because the set of exploitable patterns is practically infinite: the only reliable defense is upgrading.