Inefficient Regular Expression Parsing in whatstk by lucasrodes

CVE-2026-121577

What is CVE-2026-121577?

The vulnerability in whatstk arises from an inefficient regular expression complexity within the generate_regex() function, specifically located in whatstk's parser.py. This issue appears when processing chat exports, allowing a malicious user to create a payload that causes excessive CPU consumption without completing the parsing process. The vulnerability stems from a flaw where certain header formats are improperly handled: when a date separator is a regex metacharacter, it alters the pattern, leading to an unbounded execution time. As a result, the auto-detection feature can trigger CPU exhaustion or lead to uncaught exceptions, significantly affecting the performance and reliability of applications reliant on this library.

References