title: Is Java ReDos vulnerable?
body: <p>I tried to recreate <a href="https://en.wikipedia.org/wiki/ReDoS" rel="noreferrer">regular expression denial of service attack</a> using <code>(a+)+</code> regexp and <code>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!</code> (with large amounts of <code>a</code>) input using jshell:</p>
  
  <pre><code>Pattern.compile("(a+)+")
      .matcher("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!")
      .matches()
  </code></pre>
  
  <p>But this completes pretty quickly each time I tried. Is the regexp implementation in Java different from others? Or the linked wikipedia page is wrong?</p>
  
  <p>(BTW. I'm using Java 11, if that's relevant)</p>
  
  <p>EDIT: Looks like it is Java version related, when I tried it on Java 8, it hangs, but in Java 9 and 11 it works right away. What did change between those versions that could affect that? Are all regex safe now in Java?</p>
  
  <p>Is there a specific Java JEP that changed the regexp implementation? I would like to know what kind of regexps are still a problem for newer Java.</p>