A malicious regular expression can be stored in a source string’s flags by any user with the built‑in "Edit source" role. When such a flag is present, the expression is compiled during validation and later executed without a timeout during translation checks. A catastrophic back‑tracking pattern, for example ^(a|aa)+$, can cause the process to consume CPU resources indefinitely and stall the web request, effectively denying service to all users. The vulnerability arises from uncontrolled resource consumption in the regex engine (CWE‑400).

Weblate Org’s Weblate platform, versions earlier than 2026.7, is affected. The flaw exists in the handling of source string flags and the subsequent regex checks performed on translation content for all linked target units.

The CVSS score of 6.5 indicates moderate severity, but the lack of a timeout means that an attacker can trigger a sustained denial of service with only minimal effort. While the EPSS score is not available, the issue can be exploited through the authenticated web interface by any user who has the Edit source role; the likely attack vector is via web‑based manipulation of translation flags. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet.