Suricata

cf https://www.regular-expressions.info/catastrophic.html

As found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44742&q=label%3AProj-suricata&can=2

which basically ends up to

#include <pcre2.h>
#include <stdio.h>

int main(int argc, char **argv) {
    int en;
    PCRE2_SIZE eo;
    pcre2_code *regex = pcre2_compile((PCRE2_SPTR8)"[a-wA-Z]+\\S+.*\\s+HTTP", PCRE2_ZERO_TERMINATED, 0, &en, &eo, NULL);
    pcre2_match_data *match = pcre2_match_data_create_from_pattern(regex, NULL);
    uint8_t * input= "<horoscope><rssversion=\"2.0\"xmlns:a=\"http://schemas.microsoft.com/msn/targeting/recommend\"xmlns:msn=\"http://www.msn.com\"><channel><title>Horoscope</title><item><title>Aries</title><description>Thisisyourluckyday,Aries,andyoucanexpectallsortsofwonderfulsurprises.Youmayenjoyafinancialsurpriseorsomeonecouldproposeaninterestingandpotentiallylucrative...</description><msn:image><msn:title>Aries</msn:title><msn:link>http://a.sc.msn.com/c/my/horoscope/ari.jpg</msn:link></msn:image><msn:daterange>March20-April18</msn:daterange></item><description>ProvidedbyAstrocenter.com</description></channel></rss><ad></ad></horoscope>";
    size_t input_len = 621;
    printf("start\n");
    pcre2_match(regex, (PCRE2_SPTR8)input, input_len, 0, 0, match, NULL);
    printf("end\n");
    return 0;
}

which takes 3 seconds to run the match

rule is alert tcp any any -> any any (file.data; strip_whitespace; pcrexform:"[a-wA-Z]+\S+(.*)\s+HTTP"; content:"/z4>0m"; endswith; sid:124;)