ReDoS Bugs Are Now Far More Likely to Be Exploited Than Other Vulnerabilities, and Five Detection Tools Disagree on Which Regexes Are Vulnerable

arXiv 2609.10294·low signalXBlueskyLinkedInCopy link

arXiv 2609.10294 (submitted 9 Sep 2026) compares five publicly available regex vulnerability detection tools and one correction tool across three datasets, then analyzes every ReDoS vulnerability reported to NVD to see how they differ from non-ReDoS entries. ReDoS vulnerabilities are becoming more prevalent and are much more likely to be exploited than non-ReDoS vulnerabilities. The tools exhibit substantial disagreement on whether a given regex is vulnerable, so a single clean scan is not evidence.