🔺Severity: High
👽 Reporter: type5afe
⭐️ Reputation: 157
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-07-29
⏰ Disclosed: 2026-09-04 08:10:22
📝 Summary: A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the
pyparsing library. The grammar was ambiguous at every position and did not enable memoization, leading to exponential backtracking during parsing of search queries with nested parentheses. This resulted in a significant performance impact, with a 33-byte query string consuming 52 seconds of CPU time. The parsing was performed while holding a process-global lock, causing all other search, browse, translate, and zen page requests to stall in the same worker process.📂 Report JSON File: 3898281
@hackeronereports