CVE-2026-62326: Weblate Regular Expression DoS Vulnerability

CVE-2026-62326 Overview

Weblate is a web-based continuous localization platform used to manage software translations. CVE-2026-62326 is a denial-of-service vulnerability in Weblate versions prior to 2026.7. A user holding the built-in Edit source role can store a malicious regular expression in a source string's flags. The regex is later executed against translation content without any timeout, enabling catastrophic backtracking and sustained CPU exhaustion. The issue is fixed in Weblate version 2026.7 and is tracked as [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
An authenticated low-privilege user can trigger CPU-bound denial of service by supplying a backtracking regex through the regex: quality check or regex placeholders, stalling Weblate request handling for every linked translation unit.

Affected Products

Weblate versions prior to 2026.7
Weblate RegexCheck component (regex quality check)
Weblate PlaceholderCheck component (regex placeholders)

Discovery Timeline

2026-08-26 - CVE-2026-62326 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-62326

Vulnerability Analysis

The vulnerability resides in how Weblate compiles and executes user-supplied regular expressions stored in a source string's flags. Regex patterns supplied through the regex: quality check and regex placeholders are compiled during validation, but subsequent evaluation inside RegexCheck and PlaceholderCheck runs against translation content with no execution time limit. A crafted pattern such as ^(a|aa)+$ triggers catastrophic backtracking against benign input, consuming CPU indefinitely on a single worker.

The impact compounds because Weblate re-evaluates these checks for every linked target unit in the same request whenever a source unit's flags change. A single flag edit therefore fans out into repeated regex evaluations, converting one authenticated write into sustained denial of service across the Weblate instance.

Root Cause

The root cause is missing regex execution timeouts in weblate/checks/placeholders.py and the regex check module. The previous parse_regex helper compiled patterns via regex.compile(val) without wrapping evaluation in a timeout-aware executor, and the check classes invoked matching directly on translation content.

Attack Vector

Exploitation requires network access to a Weblate instance and an authenticated account holding the Edit source role. The attacker edits a source unit's flags to include a backtracking regex pattern via regex: or a placeholder specification. When Weblate processes the change, the pattern is executed against every linked translation unit, exhausting CPU.

python

# Patch excerpt from weblate/checks/placeholders.py
# fix(checks): enforce regex timeouts for source flags
from weblate.checks.base import TargetCheckParametrized
from weblate.checks.parser import multi_value_flag, single_value_flag
from weblate.checks.utils import merge_highlight_spans
from weblate.utils.errors import report_error
from weblate.utils.regex import regex_findall, regex_finditer


def report_regex_timeout(message: str, unit: Unit) -> None:
    report_error(message, project=unit.translation.component.project)


def parse_regex(val):
    if isinstance(val, regex.Pattern):
        return val
    if not isinstance(val, str):
        val = val.pattern
    return regex.compile(val)

Source: WeblateOrg/weblate commit 8fd8431

The patch introduces timeout-aware regex_findall and regex_finditer helpers plus a report_regex_timeout reporter, so runaway patterns are aborted and logged instead of blocking the request worker.

Detection Methods for CVE-2026-62326

Indicators of Compromise

Source unit flags containing regex patterns with nested quantifiers or overlapping alternations, such as ^(a|aa)+$, (a+)+$, or (x+x+)+y.
Weblate worker processes sustaining 100% CPU utilization tied to RegexCheck or PlaceholderCheck stack frames.
HTTP request handlers or Celery tasks timing out immediately after a source string flag edit by an Edit source role user.

Detection Strategies

Audit the Weblate database for Unit.extra_flags entries containing regex: or placeholders: values and evaluate each pattern for catastrophic-backtracking constructs.
Correlate spikes in web or Celery worker CPU with recent source unit edits recorded in the Weblate change log.
Enable Python-level profiling or Sentry report_error capture around the checks module to surface pattern evaluations exceeding a defined threshold.

Monitoring Recommendations

Alert on Weblate application worker CPU saturation lasting longer than a defined threshold (for example, 30 seconds).
Monitor the audit trail for Edit source role users modifying extra_flags on source units and flag high-frequency edits.
Ingest Weblate application logs into a centralized logging or SIEM platform to correlate flag changes with request latency and worker restarts.

How to Mitigate CVE-2026-62326

Immediate Actions Required

Upgrade Weblate to version 2026.7 or later, which enforces regex timeouts in RegexCheck and PlaceholderCheck.
Review and restrict assignment of the built-in Edit source role to trusted maintainers only.
Audit existing source unit flags and remove any regex: or placeholder patterns containing nested quantifiers or overlapping alternations.

Patch Information

The fix is delivered in Weblate 2026.7 via commit 8fd8431414bec5c86dbc94815319fc474518286a. The patch routes regex evaluation through timeout-aware regex_findall and regex_finditer helpers and reports timeout events through report_error. Full advisory details are available in the GitHub Security Advisory GHSA-r52j-4vjp-q949.

Workarounds

Revoke the Edit source role from untrusted users until the upgrade is applied.
Disable the regex: quality check and regex placeholder checks in project configuration where source flag edits cannot be tightly controlled.
Place Weblate behind a reverse proxy that enforces aggressive request timeouts and CPU cgroup limits on worker processes.

bash

# Verify Weblate version and upgrade using pip
weblate --version
pip install --upgrade 'Weblate>=2026.7'

# Or upgrade a Docker Compose deployment
docker compose pull
docker compose up -d