High-Severity Vulnerability (CVE-2026-77299) in Go's Regexp2 Engine Allows Unbounded Memory Amplification

A critical vulnerability, CVE-2026-77299, has been identified in Regexp2, a feature-rich RegExp engine for Go. The flaw allows unbounded memory amplification when compiling and matching patterns with large fixed-count quantifiers on zero-width subexpressions, potentially leading to multi-gigabyte allocations and process termination. The issue has been patched in version 2.3.0.