diff --git a/docs/api-guide/filtering.md b/docs/api-guide/filtering.md
index 8f20ad0262..705a580215 100644
--- a/docs/api-guide/filtering.md
+++ b/docs/api-guide/filtering.md
@@ -227,7 +227,7 @@ The search behavior may be specified by prefixing field names in `search_fields`
 | ------ | --------------| ------------------ |
 | `^`    | `istartswith` | Starts-with search.|
 | `=`    | `iexact`      | Exact matches.     |
-| `$`    | `iregex`      | Regex search.      |
+| `$`    | `iregex`      | Regex search (see warning below).      |
 | `@`    | `search`      | Full-text search (Currently only supported Django's [PostgreSQL backend][postgres-search]). |
 | None   | `icontains`   | Contains search (Default).  |
 
@@ -237,6 +237,9 @@ For example:
 
 By default, the search parameter is named `'search'`, but this may be overridden with the `SEARCH_PARAM` setting in the `REST_FRAMEWORK` configuration.
 
+!!! warning
+    When passing a regex to the filter via the `$` prefix or performing a `iregex` lookup, beware of maliciously crafted regular expressions that may lead to excessive CPU consumption and denial of service (DoS). Consider avoiding regex search for untrusted clients, and familiarize yourself with risky patterns (e.g., catastrophic backtracking).
+
 #### Accent-insensitive search
 
 The `UnaccentedSearchFilter` subclass performs accent-insensitive matching, so that a search for `Jeremy` also matches `Jérémy`. It behaves like `SearchFilter`, except the lookups are wrapped with the `unaccent` transform: the default lookup becomes `unaccent__icontains`, `^` becomes `unaccent__istartswith`, `=` becomes `unaccent__iexact`, and `$` becomes `unaccent__iregex`. The `@` (full-text search) prefix is left unchanged, as the `unaccent` transform cannot be combined with a full-text search lookup.