Executive brief
Weblate is a web-based translation management platform that allows teams to collaboratively translate software. Users with "Edit source" permissions can inject malicious regular expressions into source string settings that cause the server to consume excessive CPU without timeout constraints. When these rules are applied, they trigger cascading validation checks across all linked translations, potentially rendering the service unresponsive to legitimate users.
Technical details
This vulnerability is a classic uncontrolled resource consumption flaw (CWE-400) in Weblate's regex quality check and placeholder validation logic. The root cause is that regular expressions compiled from source string flags (regex: quality checks and regex placeholders) are executed in RegexCheck and PlaceholderCheck without the timeout wrapper used elsewhere in the system. Authenticated users with the built-in "Edit source" role can craft catastrophic-backtracking patterns (e.g., ^(a|aa)+$) that trigger exponential regex engine behavior. When a source unit's extra_flags are modified, Weblate re-runs validation against all linked target units synchronously in the same request, amplifying the impact. An attacker can cause sustained CPU-bound denial of service affecting server availability. The vulnerability was patched in version 2026.7 by enforcing regex timeouts during source flag evaluation.
Affected products
- Weblate Weblate prior to 2026.7
Timeline
- 2026-08-26: disclosed
- 2026-07: patched: Fix released in version 2026.7; patch commit 8fd8431 dated 2026-06-26