Hi,

The following vulnerability was published for golang-github-dlclark-regexp2.

CVE-2026-77299[0]:
| Regexp2 is a feature-rich RegExp engine for Go. Prior to version
| 2.3.0, when regexp2 compiles and matches a pattern containing a
| large fixed-count quantifier applied to a zero-width subexpression —
| e.g. (?:){50000000} — the match engine executes the empty loop body
| m-1 times, pushing two integers onto the backtracking stack on every
| iteration. Because the parser accepts any repetition count up to
| math.MaxInt32 and the backtracking stack grows without bound, a
| pattern of fewer than 20 bytes matched against an empty input can
| force multi-gigabyte allocation and OOM-kill the process.
| MatchTimeout does not fully mitigate this because the memory is
| allocated faster than the 100 ms timeout clock can fire. This issue
| has been patched in version 2.3.0.

https://github.com/dlclark/regexp2/security/advisories/GHSA-wq9v-j77v-qr26

Fixed by: https://github.com/dlclark/regexp2/commit/6e446cb3a57a0f20112bc24353604fd00bdb309a (v2.3.0)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-77299
https://www.cve.org/CVERecord?id=CVE-2026-77299

Please adjust the affected versions in the BTS as needed.