Re: ngx_http_find_virtual_server ngx_http_regex_exec DOS

2024-01-30 Thread Maxim Dounin
Hello! On Tue, Jan 30, 2024 at 10:28:23AM +0200, Clima Gabriel wrote: > Greetings fellow nginx-devs, > It looks to me as if an attacker could force the server to use up a large > amount of resources doing ngx_http_regex_exec if the server were to be > configured with a relatively large number of

ngx_http_find_virtual_server ngx_http_regex_exec DOS

2024-01-30 Thread Clima Gabriel
Greetings fellow nginx-devs, It looks to me as if an attacker could force the server to use up a large amount of resources doing ngx_http_regex_exec if the server were to be configured with a relatively large number of regex server_names. I would appreciate any ideas on the topic, especially sugges