A flaw in tiny-regex-c’s matchstar routine can be exploited with a carefully crafted regular expression to create an inefficient match that consumes excessive CPU cycles. When an attacker supplies a malicious pattern, the implementation will traverse a long exploratory path, leading to a local denial of service. The weakness is a classic resource exhaustion scenario, classified as CWE‑1333 and CWE‑400, and affects only the local execution context—remote exploitation would require the attacker to already have local code‑execution privileges or to control a component that runs the library internally.

All released versions of kokke tiny-regex-c up to commit f2632c6d9ed25272987471cdb8b70395c2460bdb are affected. The project uses a rolling‑release model, so no fixed version can be pinpointed; users must monitor the repository for a future fix.

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score is unavailable, making it unclear how often this flaw is targeted. Because the attack is restricted to local execution and no command‑execution vector is present, the risk is limited to service degradation on the local machine. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is not a widely‑being‑exploited threat yet.