Sounds kind of like the recent global Cloudflare outage. That outage started with a regex (WAF rule) being pushed out that immediately exhibited pathological backtracking behavior and "caused CPUs to become exhausted on every CPU core that handles HTTP/HTTPS traffic on the Cloudflare network worldwide."

https://blog.cloudflare.com/details-of-the-cloudflare-outage...