https://sourceware.org/glibc/wiki/Security%20Exceptions states: "Implementing regular expressions efficiently, in a standard-conforming way, and without denial-of-service vulnerabilities is very difficult and impossible for Basic Regular Expressions. Most implementation strategies have issues dealing with certain classes of patterns. Consequently, resource exhaustion issues which can be triggered only with crafted patterns (either during compilation or execution) are not treated as security bugs." Fair enough, but it would be helpful for this to be explained and documented in the manual somewhere. Users may not be aware of the security implications of regular expressions (like ReDoS attacks).