Is ReDos seen as bug/vulnerability?

[David Schumann]

Hello,

during a PenTest we found a ReDos issue in the JRE which causes
Matcher.matches() to go into an endless loop. Is such an issue considered a
bug for the JDK team (aka should I file a bug report)? Or is such an issue
considered "by design"?

The issue appears in current JRE versions (tested with 17 and 21)

Best Regards,
David Schumann
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.org/pipermail/core-libs-dev/attachments/20230127/4dad5ae7/attachment.htm>