DotVVM ReDoS vulnerability mitigated with route regex timeout

DotVVM versions 4.3.15, 4.2.11 and 5.0.0-preview09 apply a 1 second timeout to route regex operations. When timeout is triggered, DotVVM switches to non-backtracking regex engine or returns HTTP 503.

Users of DotVVM who use multiple unconstrained route parameters not separated by a '/'.

Update to DotVVM 4.3.15, 4.2.11 or 5.0.0-preview09 and avoid multiple unconstrained route parameters in one section not separated by a '/'.