I have an IRC bot written in python3 that parses user requests for search and replace. Is there any risk of DoS or other attack by doing this?
Regex can become an incredibly slow operation in Python 3 because python's re module doesn't build a DFA in the background and instead uses recursive backtracking. This means that the regular expression will take exponential time rather than linear time when applied to a string. An attacker could construct a regular expression that takes the maximum amount of time to complete by abusing recursive backtracking which can result in a DoS attack if the time to process these regexes is much slower than the possible frequency of requests.
To mitigate this problem I suggest using NFA compiling to DFA regex implementation which you may have to create yourself or find as a module somewhere. Did some preliminary searches and didn't find much to report.