Impact
Weblate lets users with the built-in "Edit source" role set additional source-string flags, including the regex: quality check and regular-expression placeholders. Those regexes are compiled successfully by validation but later executed in RegexCheck and PlaceholderCheck without the timeout wrapper Weblate uses elsewhere.
When a source unit's extra_flags changes, Weblate immediately runs checks for each linked target unit in the same request. A source editor can store a pathological regex such as ^(a|aa)+$ and cause CPU-bound request stalls when checks process matching translations.