A regular expression that can require polynomial time to match may be vulnerable to denial-of-service attacks.
