A regular expression denial of service (ReDoS) exists in the `regex replace` filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled via the `security.twig content.process enabled` variable, an authenticated page editor can provide a catastrophically backtracking PCRE pattern. This pattern is passed to the PHP `preg replace()` function, leading to unbounded CPU consumption and a denial of service for the web server process.