The vulnerability stems from the ParseSetupHandler.guessSetup method where user-supplied input (column_name_filter) is directly compiled into a regex pattern via Pattern.compile(). The lack of regex complexity checks, timeouts, or input validation allows attackers to craft regex patterns that trigger inefficient matching behavior, leading to DoS. The code reference at line 121 in the provided GitHub commit confirms this insecure pattern compilation.