diff --git a/setuptools/package_index.py b/setuptools/package_index.py

index b6407be..bdcf4a6 100755

--- a/setuptools/package_index.py

+++ b/setuptools/package_index.py

@@ -212,7 +212,7 @@ def unique_values(func):

     return wrapper

-REL = re.compile(r"""<([^>]*\srel\s*=\s*['"]?([^'">]+)[^>]*)>""", re.I)

+REL = re.compile(r"""<([^>]*\srel\s{0,10}=\s{0,10}['"]?([^'" >]+)[^>]*)>""", re.I)

 # this line is here to fix emacs' cruddy broken syntax highlighting

diff --git a/setuptools/tests/test_packageindex.py b/setuptools/tests/test_packageindex.py

index 63b9294..49bd819 100644

--- a/setuptools/tests/test_packageindex.py

+++ b/setuptools/tests/test_packageindex.py

@@ -223,6 +223,12 @@ class TestPackageIndex:

             assert dists[0].version == ''

             assert dists[1].version == vc

+    def test_REL_DoS(self):

+        """

+        REL should not hang on a contrived attack string.

+        """

+        setuptools.package_index.REL.search('< rel=' + ' ' * 2**12)

+

 class TestContentCheckers:

     def test_md5(self):