DoS with regex is a thing: https://www.owasp.org/index.php/Regular_expression_Denial_of...

StackOverflow had a similar case a while back: https://stackstatus.net/post/147710624694/outage-postmortem-...