Post #2758053

I would have never found this myself, because I would have had no reason to look for it. It's a single character typo in a regular expression that has no effect on the intended functionality, but leads to catastrophic backtracking when fed with malicious input. Why typo? Because the same pattern is used twice, and only one of them was bad. The library has 100% test coverage, including malicious input scenarios. But for this kind of issues you'd need a fuzzer. Maybe I should look into #fuzzing?