[abhinav-phi]

Description

Adds regular expression denial of service (ReDoS) to the "Input validation" section of the Denial of Service Cheat Sheet.

The section already covers request size, uploads and input-driven resource allocation, and it is exactly the kind of validation where a ReDoS hides: email, URL and username checks are the usual home of a pattern with nested or overlapping quantifiers. On a backtracking engine such a pattern takes exponential time on some inputs, so a single short request can pin a CPU core. Only the JavaScript/TypeScript and Node.js sheets mention this today, so readers on other stacks would not find it.

The new bullet follows the style of the surrounding ones and pairs every claim with a primary source:

• RE2 and Go's regexp for the linear-time engines, both of which state that match time is linear in the length of the input.
• .NET's RegexOptions.NonBacktracking and Regex.MatchTimeout for the .NET options.
• The OWASP ReDoS guidance for the attack mechanics, which describes the nested and overlapping quantifiers that cause the exponential behaviour.

The validation-side controls already live in the Input Validation Cheat Sheet, so this links to that section rather than restating it.

Scope

One cheat sheet, one added bullet. No other file is changed.

Checklist

• In case of a new Cheat Sheet, you have used the Cheat Sheet template.
• All the markdown files do not raise any validation policy violation, see the policy.
• All the markdown files follow these format rules.
• All your assets are stored in the assets folder.
• All the images used are in the PNG format.
• Any references to websites have been formatted as [TEXT](URL)
• You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
• The CI build of your PR pass, see the build status here.

Scope and sourcing (required)

• This PR is focused: it modifies a single cheat sheet, or a small coordinated set, and the scope is described in the PR body.
• Every technical claim, recommendation, or threat assertion added in this PR is supported by a primary source (RFC, NIST, OWASP standard, vendor documentation, peer-reviewed research) linked inline as [text](URL).
• I have read each source I cite and confirm it actually supports the claim. I have not relied on summaries, hearsay, or model-generated citations.

This PR fixes issue #2943.

AI Tool Usage Disclosure

• I have NOT used any AI tool to generate the contents of this PR.
• I have used AI tools to generate the contents of this PR. I have verified
  the contents and I affirm the results. The LLM used is opencode (MiniMax M3.1 Flash)
  and the prompt used is add the ReDoS bullet to the Input validation section of the Denial of Service Cheat Sheet as proposed in issue #2943, linking each claim to the primary sources named in the issue. I have independently verified every citation and
  technical claim against the cited source. The change is one bullet in one file; the
  local markdownlint, textlint and link checks pass.

[mackowski]

Thank you for your contribution. This pull request was closed automatically because it does not follow the OWASP Cheat Sheet Series contributing guide.

This pull request changes cheat sheet content, and the issue it references (#2943) has not been approved (ACK_OBTAINED) yet.
The contributing guide says only typos, broken links and small corrections may skip the issue. Updates and new cheat sheets need an approved issue first (the update_cheatsheet_proposal or new_cheatsheet_proposal template), which is then assigned to you.

What to do: open an issue describing the change and wait for it to be approved and assigned to you. Then open a pull request that ends with This PR fixes issue #<number>.

If you believe you did follow the guide and this was a mistake, please comment here or open an issue, and a maintainer will review it and reopen the pull request.

_{Closed by the Custodes pr-gate agent at 2026-11-11 20:45 UTC, rule no_approved_issue. Maintainers are notified of every close.}

---

_{🛡️ Custodes-Agent: pr-gate@0.1.0 · Custodes-Attestation: d368209e-604b-4d95-91fd-cea1ae7848e8 · verify}

[abhinav-phi]

The change is ready, but the issue it references is not acknowledged yet.

#2943 describes exactly this change and has not been given ACK_OBTAINED, so the gate closed this pull request. I am not reopening it on my own, since the reporter said in the issue that they are happy to open the pull request once it is acknowledged.

The whole change is one bullet in cheatsheets/Denial_of_Service_Cheat_Sheet.md, and it is also posted in full on #2943 so it can be applied without opening this pull request. Every source it links was read and checked against the claim it supports, and markdownlint, textlint and the link check pass locally.

If the issue is approved and assigned to a contributor, this pull request can be reopened as is.