Regex DoS (ARCH8135)

Key kotlin.security.regex-dos · Severity warning · Category security · CWE CWE-1333

Flags regex literals with nested quantifiers ((a+)+, (\w*)*) that backtrack catastrophically on crafted input.

Incorrect

Regex("(a+)+$")

Correct

Regex("a+$")

Fix

Rewrite the pattern without nested quantifiers, or bound the input length.