Regular expression Denial of Service attacks are a type of DoS in which the attacker uses inputs that take a long time for the computer to evaluate/process to create a denial-of-service error. The error is produced when the program is unable the evaluate the expression because of the input size. ReDoS attacks take advantage of "evil" aspects of a regular expression(regex) which overloads the server making it inaccessible to its users. According to a study by Adar Weidman, a Code Analysis Architect at the OWASP Foundation, “In every layer of the WEB there are Regular Expressions, that might contain an Evil Regex. An attacker can hang a WEB-browser (on a computer or potentially also on a mobile device), hang a Web Application Firewall (WAF), attack a database, and even stack a vulnerable WEB server.” This type of an attack could be costly to big corporations because application outages caused by ReDoS can degrade the operational efficiency, reduced revenues, and damaged the brand reputation. It is also important to know that ReDoS can breach sensitive user information. According to Contrast Security, "Other repercussions include penalties from sensitive data exposure, which result in $50,000 per attack on average."
