Hunting ReDoS vulnerabilities, fuzzing stateful protocols, and tracing vulnerable versions — hardening software at the intersection of security and reliability.
Regular-expression Denial of Service (ReDoS) hides in nested quantifiers that trigger catastrophic backtracking. RegexScalpel localizes the vulnerable sub-pattern, then fixes it in place — preserving semantics while killing the exponential blow-up.
A two-phase pipeline: static analysis parses the regex into an NFA and flags ambiguous, self-overlapping paths across five vulnerability patterns; dynamic analysis then feeds crafted attack strings, assessing the exponential-vs-polynomial degree of blow-up as the execution-time meter climbs past the danger threshold.
aStateful protocols only reveal bugs deep in their state machine. This empirical study puts 6 state-of-the-art fuzzers (including AFLNet) through their paces on 13 widely-used programs across the FTP, SIP, and RTSP protocols — finding that state-coverage guidance helps navigate the state space but yields limited code-coverage gains, while sequence mutation proves pivotal. The demo below illustrates the general idea: walking legal transitions until a malformed packet forces an unexpected transition, here jumping straight to DATA, bypassing AUTH.
A CVE rarely affects a single release. Starting from the version that introduced the flaw, the vulnerability propagates forward across every release until a patch lands — identifying that precise affected range is the crux of accurate vulnerability triage.