Regex backtracking

What happens#

A new WAF rule backtracked on long inputs. Every WAF ran at 100% CPU.

How to prevent it#

Roll rules out to a canary first. Disable the rule to end it.

Engineering terms#

• Canary deployment
• ReDoS (regular expression denial of service)