# CVE-2026-62326: Weblate regex denial of service in source string flags

Source: https://junglewise.ai/threats/cve-2026-62326-weblate-regex-denial-of-service-in-source-string-flags  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62326 · Severity: medium · CVSS 6.5 · Published 2026-08-26

Weblate is a web-based translation management platform that allows teams to collaboratively translate software. Users with "Edit source" permissions can inject malicious regular expressions into source string settings that cause the server to consume excessive CPU without timeout constraints. When these rules are applied, they trigger cascading validation checks across all linked translations, potentially rendering the service unresponsive to legitimate users.

## Quick answers

**Is CVE-2026-62326 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62326 being exploited in the wild.

**How severe is CVE-2026-62326?** Medium severity, with a CVSS score of 6.5, published 26 August 2026.

**Which products and versions are affected?** Weblate Weblate prior to 2026.7.

**Is there a fix for CVE-2026-62326?** A patch was published on 2026-07: Fix released in version 2026.7; patch commit 8fd8431 dated 2026-06-26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62326 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-62326?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a classic uncontrolled resource consumption flaw (CWE-400) in Weblate's regex quality check and placeholder validation logic. The root cause is that regular expressions compiled from source string flags (regex: quality checks and regex placeholders) are executed in RegexCheck and PlaceholderCheck without the timeout wrapper used elsewhere in the system. Authenticated users with the built-in "Edit source" role can craft catastrophic-backtracking patterns (e.g., ^(a|aa)+$) that trigger exponential regex engine behavior. When a source unit's extra_flags are modified, Weblate re-runs validation against all linked target units synchronously in the same request, amplifying the impact. An attacker can cause sustained CPU-bound denial of service affecting server availability. The vulnerability was patched in version 2026.7 by enforcing regex timeouts during source flag evaluation.

## Affected products

- Weblate Weblate prior to 2026.7

## Timeline

- 2026-08-26: disclosed
- 2026-07: patched: Fix released in version 2026.7; patch commit 8fd8431 dated 2026-06-26

## References

- [https://github.com/WeblateOrg/weblate/commit/8fd8431414bec5c86dbc94815319fc474518286a](https://github.com/WeblateOrg/weblate/commit/8fd8431414bec5c86dbc94815319fc474518286a)
- [https://github.com/WeblateOrg/weblate/security/advisories/GHSA-r52j-4vjp-q949](https://github.com/WeblateOrg/weblate/security/advisories/GHSA-r52j-4vjp-q949)