@@ -32,6 +32,7 @@ public enum Key {
     PATTERN_BUFFER_LIMIT("plugins.ppl.pattern.buffer.limit"),
     PATTERN_SHOW_NUMBERED_TOKEN("plugins.ppl.pattern.show.numbered.token"),
     PPL_REX_MAX_MATCH_LIMIT("plugins.ppl.rex.max_match.limit"),
+    PPL_REGEX_MATCH_LIMIT("plugins.ppl.regex.match.limit"),
     PPL_VALUES_MAX_LIMIT("plugins.ppl.values.max.limit"),
     PPL_SYNTAX_LEGACY_PREFERRED("plugins.ppl.syntax.legacy.preferred"),
     PPL_SUBSEARCH_MAXOUT("plugins.ppl.subsearch.maxout"),
 
@@ -8,50 +8,53 @@
 import java.util.regex.Pattern;
 
 /**
- * A {@link CharSequence} that wraps another sequence and caps how many {@code charAt} accesses a
- * regex engine may perform against it. Once accesses exceed {@code limitFactor * length} the match
+ * A {@link CharSequence} that wraps another sequence and caps the total number of {@code charAt}
+ * accesses a regex engine may perform against it. Once accesses exceed {@code matchLimit} the match
  * is aborted with an {@link IllegalArgumentException}, bounding worst-case backtracking work
  * without changing the regex engine or affecting normal matches.
  *
+ * <p>The cap is an absolute total (not scaled by input length), analogous to PCRE2's {@code
+ * match_limit} (and Splunk {@code rex}'s {@code match_limit}, default 100000), which bounds how
+ * many times the matcher's internal loop runs. A catastrophic pattern re-reads characters far past
+ * this cap and is aborted in well under a millisecond, regardless of how the attacker sizes the
+ * input.
+ *
  * <p>Adapted from {@code org.opensearch.painless.api.LimitedCharSequence}; kept plugin-local to
  * avoid a {@code lang-painless} dependency.
  */
 public final class LimitedCharSequence implements CharSequence {
   private final CharSequence wrapped;
-  private final Counter counter;
+  private final long matchLimit;
+  private long count;
 
   // Retained for the error message only.
   private final Pattern pattern;
-  private final int limitFactor;
 
   static final int MAX_STR_LENGTH = 64;
   private static final String SNIPPET = "...";
 
   /**
    * @param wrap the input text the regex engine will read
    * @param pattern the pattern being matched (for the error message only; may be null)
-   * @param limitFactor charAt budget as a multiple of input length; must be positive
+   * @param matchLimit absolute cap on total charAt reads before the match is aborted; must be
+   *     positive
    */
-  public LimitedCharSequence(CharSequence wrap, Pattern pattern, int limitFactor) {
-    if (limitFactor <= 0) {
-      throw new IllegalArgumentException("limitFactor must be positive");
+  public LimitedCharSequence(CharSequence wrap, Pattern pattern, long matchLimit) {
+    if (matchLimit <= 0) {
+      throw new IllegalArgumentException("matchLimit must be positive");
     }
     this.wrapped = wrap;
-    this.counter = new Counter((long) limitFactor * wrapped.length());
+    this.matchLimit = matchLimit;
     this.pattern = pattern;
-    this.limitFactor = limitFactor;
   }
 
   String details() {
     return (pattern != null ? "pattern: [" + pattern.pattern() + "], " : "")
-        + "limit factor: ["
-        + limitFactor
-        + "], "
-        + "char limit: ["
-        + counter.charAtLimit
+        + "match limit: ["
+        + matchLimit
         + "], "
         + "count: ["
-        + counter.count
+        + count
         + "], "
         + "wrapped: ["
         + snippet(MAX_STR_LENGTH)
@@ -84,13 +87,14 @@ public int length() {
 
   @Override
   public char charAt(int index) {
-    counter.count++;
-    if (counter.hitLimit()) {
+    count++;
+    if (count > matchLimit) {
       throw new IllegalArgumentException(
           "Regular expression in PPL parse/rex command considered too many characters, "
               + details()
               + ". The pattern and input combination is too expensive to evaluate (possible"
-              + " catastrophic backtracking).");
+              + " catastrophic backtracking). This limit can be changed with the"
+              + " plugins.ppl.regex.match.limit setting.");
     }
     return wrapped.charAt(index);
   }
@@ -104,19 +108,4 @@ public CharSequence subSequence(int start, int end) {
   public String toString() {
     return wrapped.toString();
   }
-
-  /** Tracks charAt accesses across the wrapped sequence. */
-  private static final class Counter {
-    final long charAtLimit;
-    long count;
-
-    Counter(long charAtLimit) {
-      this.charAtLimit = charAtLimit;
-      this.count = 0;
-    }
-
-    boolean hitLimit() {
-      return count > charAtLimit;
-    }
-  }
 }
@@ -31,10 +31,33 @@ public class RegexCommonUtils {
   private static final Pattern ANY_NAMED_GROUP_PATTERN = Pattern.compile("\\(\\?<([^>]+)>");
 
   /**
-   * Max characters the regex engine may read per input character before a match is aborted.
-   * Generous enough never to trip legitimate matches; mirrors OpenSearch's painless regex guard.
+   * Default absolute cap on the number of characters the regex engine may read in a single match
+   * before it is aborted. Mirrors the default of PCRE2's {@code match_limit} as adopted by Splunk
+   * {@code rex} (100000): high enough never to trip legitimate matches, low enough that a
+   * catastrophic match aborts in well under a millisecond. Overridable via the {@code
+   * plugins.ppl.regex.match.limit} setting through {@link #setMatchLimit(long)}.
    */
-  private static final int REGEX_LIMIT_FACTOR = 10_000;
+  public static final long DEFAULT_MATCH_LIMIT = 100_000L;
+
+  // Node-scoped value, pushed in by the OpenSearch settings layer on register and on dynamic
+  // change. volatile so updates are visible to matching threads.
+  private static volatile long matchLimit = DEFAULT_MATCH_LIMIT;
+
+  /**
+   * Set the absolute per-match character-read cap. Called by the OpenSearch settings layer when
+   * {@code plugins.ppl.regex.match.limit} is registered or changed. Non-positive values are ignored
+   * (the previous value is kept) so a misconfiguration cannot disable the guard.
+   */
+  public static void setMatchLimit(long limit) {
+    if (limit > 0) {
+      matchLimit = limit;
+    }
+  }
+
+  /** Current absolute per-match character-read cap. */
+  public static long getMatchLimit() {
+    return matchLimit;
+  }
 
   private static final int MAX_CACHE_SIZE = 1000;
 
@@ -123,7 +146,7 @@ private static boolean isValidJavaRegexGroupName(String groupName) {
    * @return a Matcher over a length-bounded view of the text
    */
   public static Matcher boundedMatcher(Pattern pattern, String text) {
-    return pattern.matcher(new LimitedCharSequence(text, pattern, REGEX_LIMIT_FACTOR));
+    return pattern.matcher(new LimitedCharSequence(text, pattern, matchLimit));
   }
 
   /**
 
@@ -16,7 +16,7 @@ public class LimitedCharSequenceTest {
 
   @Test
   public void delegatesLengthAndCharAtAndToString() {
-    LimitedCharSequence seq = new LimitedCharSequence("abcde", null, 10);
+    LimitedCharSequence seq = new LimitedCharSequence("abcde", null, 100);
     assertEquals(5, seq.length());
     assertEquals('a', seq.charAt(0));
     assertEquals('e', seq.charAt(4));
@@ -25,46 +25,57 @@ public void delegatesLengthAndCharAtAndToString() {
   }
 
   @Test
-  public void rejectsNonPositiveLimitFactor() {
+  public void rejectsNonPositiveMatchLimit() {
     assertThrows(IllegalArgumentException.class, () -> new LimitedCharSequence("abc", null, 0));
     assertThrows(IllegalArgumentException.class, () -> new LimitedCharSequence("abc", null, -1));
   }
 
   @Test
-  public void throwsAfterExceedingCharAtBudget() {
-    // limitFactor 2 * length 3 = budget of 6 charAt calls; the 7th must throw.
-    LimitedCharSequence seq = new LimitedCharSequence("abc", null, 2);
-    for (int i = 0; i < 6; i++) {
-      seq.charAt(0); // 6 reads are allowed (count > limit is the trip condition)
+  public void throwsAfterExceedingAbsoluteCap() {
+    // Absolute cap of 5 charAt reads, independent of input length; the 6th must throw.
+    LimitedCharSequence seq = new LimitedCharSequence("abc", null, 5);
+    for (int i = 0; i < 5; i++) {
+      seq.charAt(0); // 5 reads are allowed (count > limit is the trip condition)
     }
     assertThrows(IllegalArgumentException.class, () -> seq.charAt(0));
   }
 
   @Test
-  public void errorMessageIncludesPatternAndCounts() {
+  public void capIsAbsoluteNotScaledByLength() {
+    // A 1000-char input with a cap of 3 still trips on the 4th read — the cap does not scale with
+    // input length (unlike the old factor model). This is what closes the short-input bypass.
+    LimitedCharSequence seq = new LimitedCharSequence("x".repeat(1000), null, 3);
+    seq.charAt(0);
+    seq.charAt(0);
+    seq.charAt(0);
+    assertThrows(IllegalArgumentException.class, () -> seq.charAt(0));
+  }
+
+  @Test
+  public void errorMessageIncludesPatternAndLimit() {
     Pattern pattern = Pattern.compile("(a+)+");
-    LimitedCharSequence seq = new LimitedCharSequence("ab", pattern, 1);
-    // budget = 1 * 2 = 2; third read trips.
+    LimitedCharSequence seq = new LimitedCharSequence("ab", pattern, 2);
     seq.charAt(0);
     seq.charAt(0);
     IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () -> seq.charAt(0));
     assertTrue(e.getMessage().contains("too many characters"));
     assertTrue(e.getMessage().contains("(a+)+"), "should include the offending pattern");
-    assertTrue(e.getMessage().contains("limit factor: [1]"));
+    assertTrue(e.getMessage().contains("match limit: [2]"));
+    assertTrue(e.getMessage().contains("plugins.ppl.regex.match.limit"));
   }
 
   @Test
   public void snippetTruncatesLongInput() {
     String longInput = "x".repeat(200);
-    LimitedCharSequence seq = new LimitedCharSequence(longInput, null, 10);
+    LimitedCharSequence seq = new LimitedCharSequence(longInput, null, 1_000_000);
     String snippet = seq.snippet(LimitedCharSequence.MAX_STR_LENGTH);
     assertTrue(snippet.length() <= LimitedCharSequence.MAX_STR_LENGTH);
     assertTrue(snippet.endsWith("..."));
   }
 
   @Test
   public void snippetReturnsFullShortInput() {
-    LimitedCharSequence seq = new LimitedCharSequence("short", null, 10);
+    LimitedCharSequence seq = new LimitedCharSequence("short", null, 1_000_000);
     assertEquals("short", seq.snippet(LimitedCharSequence.MAX_STR_LENGTH));
   }
 }
@@ -371,9 +371,50 @@ public void legitimatePatternsStillMatchAfterGuard() {
   @Test
   public void legitimateLongInputDoesNotTripGuard() {
     // A 50k-char input matched by a linear pattern reads each char a small constant number of
-    // times, far under the limit factor, so it must not trip.
+    // times, far under the match limit, so it must not trip.
     Pattern pattern = RegexCommonUtils.getCompiledPattern("(?<all>.*)");
     String longInput = "x".repeat(50_000);
     assertEquals(longInput, RegexCommonUtils.extractNamedGroup(longInput, pattern, "all"));
   }
+
+  @Test
+  public void defaultMatchLimitIsSplunkAligned() {
+    // Mirrors Splunk rex / PCRE2 match_limit default of 100000.
+    assertEquals(100_000L, RegexCommonUtils.DEFAULT_MATCH_LIMIT);
+    assertEquals(100_000L, RegexCommonUtils.getMatchLimit());
+  }
+
+  @Test
+  public void setMatchLimitChangesTheEffectiveCap() {
+    long original = RegexCommonUtils.getMatchLimit();
+    try {
+      // Lower the cap so a normally-fine linear match over long input now trips.
+      RegexCommonUtils.setMatchLimit(100L);
+      assertEquals(100L, RegexCommonUtils.getMatchLimit());
+      Pattern pattern = RegexCommonUtils.getCompiledPattern("(?<all>.*)");
+      String input = "x".repeat(1_000); // ~1000 reads > 100 cap
+      assertThrows(
+          IllegalArgumentException.class,
+          () -> RegexCommonUtils.extractNamedGroup(input, pattern, "all"));
+      // Raise it back high; the same match now succeeds.
+      RegexCommonUtils.setMatchLimit(1_000_000L);
+      assertEquals(input, RegexCommonUtils.extractNamedGroup(input, pattern, "all"));
+    } finally {
+      RegexCommonUtils.setMatchLimit(original);
+    }
+  }
+
+  @Test
+  public void setMatchLimitIgnoresNonPositiveValues() {
+    long original = RegexCommonUtils.getMatchLimit();
+    try {
+      RegexCommonUtils.setMatchLimit(500L);
+      RegexCommonUtils.setMatchLimit(0L); // ignored — must not disable the guard
+      assertEquals(500L, RegexCommonUtils.getMatchLimit());
+      RegexCommonUtils.setMatchLimit(-1L); // ignored
+      assertEquals(500L, RegexCommonUtils.getMatchLimit());
+    } finally {
+      RegexCommonUtils.setMatchLimit(original);
+    }
+  }
 }
@@ -30,6 +30,7 @@
 import org.opensearch.index.IndexSettings;
 import org.opensearch.search.aggregations.MultiBucketConsumerService;
 import org.opensearch.sql.common.setting.Settings;
+import org.opensearch.sql.expression.parse.RegexCommonUtils;
 
 /** Setting implementation on OpenSearch. */
 @Log4j2
@@ -129,6 +130,14 @@ public class OpenSearchSettings extends Settings {
           Setting.Property.NodeScope,
           Setting.Property.Dynamic);
 
+  public static final Setting<?> PPL_REGEX_MATCH_LIMIT_SETTING =
+      Setting.longSetting(
+          Key.PPL_REGEX_MATCH_LIMIT.getKeyValue(),
+          RegexCommonUtils.DEFAULT_MATCH_LIMIT,
+          1L,
+          Setting.Property.NodeScope,
+          Setting.Property.Dynamic);
+
   public static final Setting<?> PPL_VALUES_MAX_LIMIT_SETTING =
       Setting.intSetting(
           Key.PPL_VALUES_MAX_LIMIT.getKeyValue(),
@@ -419,6 +428,23 @@ public OpenSearchSettings(ClusterSettings clusterSettings) {
         Key.PPL_REX_MAX_MATCH_LIMIT,
         PPL_REX_MAX_MATCH_LIMIT_SETTING,
         new Updater(Key.PPL_REX_MAX_MATCH_LIMIT));
+    Updater regexMatchLimitUpdater = new Updater(Key.PPL_REGEX_MATCH_LIMIT);
+    register(
+        settingBuilder,
+        clusterSettings,
+        Key.PPL_REGEX_MATCH_LIMIT,
+        PPL_REGEX_MATCH_LIMIT_SETTING,
+        // Keep the static guard in RegexCommonUtils (in the engine-agnostic core module) in sync
+        // on both registration and dynamic change, since parse/rex matching is evaluated there.
+        newValue -> {
+          regexMatchLimitUpdater.accept(newValue);
+          RegexCommonUtils.setMatchLimit(((Number) newValue).longValue());
+        });
+    // Seed the initial value: the update consumer above only fires on subsequent changes.
+    Object regexMatchLimit = clusterSettings.get(PPL_REGEX_MATCH_LIMIT_SETTING);
+    if (regexMatchLimit != null) {
+      RegexCommonUtils.setMatchLimit(((Number) regexMatchLimit).longValue());
+    }
     register(
         settingBuilder,
         clusterSettings,
@@ -664,6 +690,7 @@ public static List<Setting<?>> pluginSettings() {
         .add(DEFAULT_PATTERN_BUFFER_LIMIT_SETTING)
         .add(DEFAULT_PATTERN_SHOW_NUMBERED_TOKEN_SETTING)
         .add(PPL_REX_MAX_MATCH_LIMIT_SETTING)
+        .add(PPL_REGEX_MATCH_LIMIT_SETTING)
         .add(PPL_VALUES_MAX_LIMIT_SETTING)
         .add(PPL_SUBSEARCH_MAXOUT_SETTING)
         .add(PPL_JOIN_SUBSEARCH_MAXOUT_SETTING)
 
@@ -115,6 +115,31 @@ void testPplValuesMaxLimitSetting() {
     assertEquals(5000, newLimit);
   }
 
+  @Test
+  void testPplRegexMatchLimitSetting() {
+    long original = org.opensearch.sql.expression.parse.RegexCommonUtils.getMatchLimit();
+    try {
+      when(clusterSettings.get(ClusterName.CLUSTER_NAME_SETTING)).thenReturn(ClusterName.DEFAULT);
+      when(clusterSettings.get(not((eq(ClusterName.CLUSTER_NAME_SETTING))))).thenReturn(null);
+      OpenSearchSettings settings = new OpenSearchSettings(clusterSettings);
+
+      // Default value mirrors Splunk rex / PCRE2 match_limit (100000).
+      Long defaultLimit = settings.getSettingValue(Settings.Key.PPL_REGEX_MATCH_LIMIT);
+      assertEquals(100000L, defaultLimit);
+
+      // A dynamic update propagates to the RegexCommonUtils static guard used by parse/rex.
+      OpenSearchSettings.Updater updater = settings.new Updater(Settings.Key.PPL_REGEX_MATCH_LIMIT);
+      updater.accept(250L);
+      // The registered consumer also pushes to RegexCommonUtils; simulate that side of the wiring.
+      org.opensearch.sql.expression.parse.RegexCommonUtils.setMatchLimit(250L);
+
+      assertEquals(250L, (long) settings.getSettingValue(Settings.Key.PPL_REGEX_MATCH_LIMIT));
+      assertEquals(250L, org.opensearch.sql.expression.parse.RegexCommonUtils.getMatchLimit());
+    } finally {
+      org.opensearch.sql.expression.parse.RegexCommonUtils.setMatchLimit(original);
+    }
+  }
+
   @Test
   void getSparkExecutionEngineConfigSetting() {
     // Default is empty string