2026-05-04 17:52 UTCOriginal source1 min readUpdated: 2026-06-30 13:03 UTC

TRE Python binding — ReDoS robustness demo

Summary

Simon Willison explores Ville Laurikari's TRE regex engine by building an experimental Python ctypes binding with Claude Code and testing it against malicious regex attacks. TRE, due to its lack of backtracking, handles 'evil patterns' and large inputs far better than Python's standard re module, scaling linearly instead of exponentially.

SourceSimon Willison's Weblog

Report an error

The correction channel is not available yet. You can copy the article reference below for later.

Correction instructions

Read article

Research: TRE Python binding — ReDoS robustness demo

Simon Willison’s Weblog

Sponsored by: MongoDB — Join MongoDB.local London 2026 on 7 May to learn how teams move AI from prototype to production.

4th May 2026

Research

TRE Python binding — ReDoS robustness demo — Demonstrating robust regex performance, this project offers a minimal Python ctypes binding to the TRE regex library, highlighting TRE’s immunity to regular expression denial-of-service (ReDoS) attacks that cripple Python's built-in re module. Key benchmarks show that TRE processes even notorious "evil" patterns on gigantic inputs (10 million characters) much faster than re on tiny ones, and scales linearly with input size instead of exponentially.

If it's good enough for antirez to add to Redis I figured Ville Laurikari's TRE regular expression engine was worth exploring in a little more detail.

I had Claude Code build an experimental Python binding (it used ctypes) and try some malicious regular expression attacks against the library. TRE handles those much better than Python's standard library implementation, thanks mainly to the lack of support for backtracking.

Posted 4th May 2026 at 5:52 pm

Article intelligence

EngineersAdvanced

Key points

TRE regex engine by Ville Laurikari, already adopted in Redis by antirez, is known for resistance to ReDoS attacks.
Simon Willison created a Python ctypes binding for TRE using Claude Code and tested it against malicious regex patterns.
Without backtracking support, TRE processes 10-million-character evil patterns faster than Python's re module handles tiny inputs, with linear scaling.
TRE offers a robust alternative to Python's re module, mitigating ReDoS vulnerabilities.

Highlights and analysis are generated automatically and may contain errors. Check the original source.

Article intelligence

Key points

More recent stories on this topic · Research