The vulnerability arises from the way the application handles user-supplied regular expressions for text processing. When an attacker submits a specially crafted regular expression, such as '(a+)+b', the application's regular expression engine consumes excessive resources trying to match this pattern, leading to a Denial of Service (DoS) condition. This is particularly problematic in applications that rely on real-time processing or have limited computational resources.

An attacker crafts a JSON payload containing a malicious regular expression and sends it to the application's text processing endpoint via a POST request. The application attempts to process the regular expression, leading to excessive resource consumption and ultimately causing the application to crash or become unresponsive.

Any users or systems that rely on the lunary-ai/lunary library version 1.2.10 for processing text with custom regular expressions are vulnerable to this attack. This includes web applications, data processing services, and any other software that utilizes this library for text analysis or manipulation.