CVE-2026-62326: Weblate Has Uncontrolled Resource Consumption via
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny service. Regular expressions supplied through the regex: quality check and regex placeholders are compiled during validation but later run against translation content in RegexCheck and PlaceholderCheck with no time limit, so a catastrophic-backtracking pattern like ^(a|aa)+$ can consume CPU indefinitely. Because Weblate re-runs these checks for every linked target unit in the same request when a source unit's flags change, a single edit can trigger sustained CPU-bound denial of service. This issue is fixed in version 2026.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Weblateto a version that resolves this vulnerability.Fixed in 2026.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with Weblate's built-in "Edit source" role can exploit it by storing a malicious regular expression in a source string's flags. No user interaction is required.
Are default deployments affected?
Deployments are affected if they run a version earlier than 2026.7 and grant a user the built-in "Edit source" role. The issue involves regex-based quality checks and placeholders that are executed against translation content without a time limit.
What can be done if upgrading is not immediately possible?
Restrict the "Edit source" role to trusted users and review source-string flags for malicious or excessively complex regular expressions. This reduces the ability to introduce patterns that can cause catastrophic backtracking and consume CPU.
How can an administrator identify possible exploitation?
Look for source-string flag changes containing complex regular expressions, especially catastrophic-backtracking patterns such as ^(a|aa)+$. Affected requests may become CPU-bound or stall while checks are rerun for linked target units.