1. A security appliance operatively coupled to a network, the security appliance comprising: at least one memory configured to store a first finite automaton, at least one second finite automaton, and a run stack; and at least one processor operatively coupled to the at least one memory and configured to search for at least one regular expression pattern in a flow, the search including: initializing a search context in the run stack based on (i) partial match results determined from walking segments of a payload of the flow through the first finite automaton and (ii) a historical search context associated with the flow; modifying the search context via push or pop operations to direct the at least one processor to walk segments of the payload through the at least one second finite automaton to explore whether at least one partial match of at least one regular expression pattern identified via the first automaton advances along at least one path of the at least one second finite automaton; and maintaining the search context in a manner obviating overflow of the search context and obviating stalling of the push or pop operations.