Denial of Service Vulnerability in Weblate by Weblate
CVE-2026-62326

6.5MEDIUM

Key Information:

Vendor

Weblateorg

Status
Weblate
Vendor
CVE Published:
26 August 2026

What is CVE-2026-62326?

Weblate, a web-based continuous localization platform, is susceptible to a denial of service due to improper handling of malicious regular expressions in source strings. Users with the 'Edit source' role can input hazardous regex patterns that lead to indefinite CPU consumption, causing the system to stall and potentially deny service. This is due to the lack of execution time limits when validating these patterns during translation content checks. Such vulnerabilities can be triggered by a single modification, affecting all linked units, thereby amplifying the denial of service risk. The issue has been addressed in version 2026.7.

Affected Version(s)

weblate < 2026.7

References

https://github.com/WeblateOrg/weblate/security/advisories...
x_refsource_CONFIRM
https://github.com/WeblateOrg/weblate/commit/8fd8431414be...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.