Hello,

during a PenTest we found a ReDos issue in the JRE which causes
Matcher.matches() to go into an endless loop. Is such an issue considered a
bug for the JDK team (aka should I file a bug report)? Or is such an issue
considered "by design"?

The issue appears in current JRE versions (tested with 17 and 21)

Best Regards,
David Schumann

Reply via email to