Zulip is an open source team chat server that allows organization administrators to configure linkifiers, which automatically create links from messages sent by users, detected via arbitrary regular expressions. Malicious organization administrators could subject the server to a denial-of-service via regular expression complexity attacks by configuring a quadratic-time regular expression in a linkifier and sending messages that exploited it. The regular expression attempted to parse user-provided regexes to verify they were safe from ReDoS, but this was insufficient and itself subject to ReDoS if the organization administrator entered a sufficiently complex invalid regex.