**Type of Issue** Potential Regex Denial of Service (ReDoS) **Description** The vulnerable regular expression is located in https://github.com/pytest-dev/py/blob/1a45e12100950ea1007554e239d44fb7472347b3/py/_path/svnwc.py#L399 The ReDOS vulnerabilitiy of the regex is mainly due to the sub-pattern (\d+)\s*(\S+) and can be exploited with the following string "1"*5000 I think you can limit the input length or modify this regex.