Perl already refuses to execute (?{'s that come from interpolated strings unless use re "eval" is in force. So you should be fairly safe. Of course the DOS can include memory exhaustion too.