# CVE-2026-121577: whatstk inefficient regular expression in header parsing

Source: https://junglewise.ai/threats/cve-2026-121577-inefficient-regular-expression-complexity-cwe-1333-in-generate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121577 · Severity: info · Published 2026-11-03

whatstk is a Python library that parses WhatsApp chat exports. A flaw in its header detection can be exploited by supplying a specially crafted chat export file that causes the parser to consume CPU indefinitely or crash with an unhandled exception, making the application hang or fail when processing the file.

Technologies: [Whatstk](https://junglewise.ai/threats/technologies/whatstk). Vendors: [Whatstk](https://junglewise.ai/threats/vendors/whatstk).

## Quick answers

**Is CVE-2026-121577 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121577 being exploited in the wild.

**How severe is CVE-2026-121577?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** Whatstk 0.2.0 before 0.9.0.

**Is there a fix for CVE-2026-121577?** Yes: fixed in 0.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121577 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121577?** Check whether you run Whatstk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.9.0

## Technical details

The generate_regex() function in whatstk/whatsapp/parser.py fails to escape regular expression metacharacters when building the header pattern from auto-detected format strings. When a chat export contains metacharacters like +, *, |, ?, (, ), \, ^, or $ as date separators, they are interpreted as regex operators rather than literals, causing catastrophic backtracking or unhandled exceptions. An attacker who supplies a malicious chat export can trigger unbounded CPU consumption or crash the parser.

## Affected products

- whatstk whatstk 0.2.0 before 0.9.0

## Timeline

- 2026-11-03: disclosed

## References

- [https://pypi.org/](https://pypi.org/)
- [https://github.com/lucasrodes/whatstk/commit/01d66d8](https://github.com/lucasrodes/whatstk/commit/01d66d8)

## Related threats

- [whatstk message loss in merge_chats() due to incomplete date comparison](https://junglewise.ai/threats/cve-2026-121564-incomplete-comparison-with-missing-factors-cwe-1023-in-merge)