CVE-2026-62326

Received Received - Intake

Regular Expression Denial of Service in Weblate

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny service. Regular expressions supplied through the regex: quality check and regex placeholders are compiled during validation but later run against translation content in RegexCheck and PlaceholderCheck with no time limit, so a catastrophic-backtracking pattern like ^(a|aa)+$ can consume CPU indefinitely. Because Weblate re-runs these checks for every linked target unit in the same request when a source unit's flags change, a single edit can trigger sustained CPU-bound denial of service. This issue is fixed in version 2026.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-62326

Affected Vendors & Products

Vendor	Product	Version / Range
weblate	weblate	2026.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects Weblate versions before 2026.7. A user with the 'Edit source' role can exploit a regular expression flaw to cause denial of service by creating a pattern that leads to infinite CPU usage, stalling requests.

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU usage or stalled requests in Weblate instances running versions prior to 2026.7. Check logs for regex validation or placeholder checks taking excessive time. Use system monitoring tools like top, htop, or ps to identify processes consuming abnormal CPU resources.

Impact Analysis

If exploited, this vulnerability can cause system slowdowns or crashes due to excessive CPU usage. It may disrupt service availability for all users relying on the Weblate instance.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing service disruptions due to denial-of-service conditions. GDPR requires availability of personal data processing systems, and HIPAA mandates timely access to protected health information. A prolonged outage could violate these requirements.

Mitigation Strategies

Upgrade Weblate to version 2026.7 or later immediately. Remove or restrict the 'Edit source' role for users until the upgrade is complete. Review and remove any suspicious regex patterns in source strings or flags. Implement rate limiting or timeout settings for regex validation processes.

Hi! I’m here to help you understand CVE-2026-62326. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70