> It's a Bad Idea (TM) to compile a regular expression from an untrusted input.

i agree with you!

nevertheless,

> where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment

not sure what sort of comprehensive assessment is still called for at this point?