Threats affecting pkg:golang/github.com/dlclark/regexp2

CVE-2026-77299 is a high-severity vulnerability in the dlclark regexp2 library for Go, affecting versions prior to 2.3.0. It involves uncontrolled resource consumption when compiling and matching patterns with large fixed-count quantifiers applied to zero-width subexpressions. This can cause the match engine to allocate multi-gigabyte memory, potentially leading to out-of-memory (OOM) termination of the process. The issue is patched in version 2.3.0.