CVE-2026-16270 in Open Mercato
Summary
by MITRE • 07/22/2026
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack.
This issue was fixed in version 0.6.4.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability in Open Mercato involves a critical weakness in regex validation mechanisms that creates potential for denial of service attacks through malicious input manipulation. This flaw exists within the system's regex rule creation functionality where proper validation checks are absent, allowing unauthorized users with sufficient privileges to inject unsafe regular expressions into system fields. The vulnerability represents a direct violation of secure coding practices and demonstrates inadequate input sanitization controls.
The technical implementation of this weakness stems from the absence of proper regex validation during rule creation processes within the Open Mercato platform. When attackers with appropriate privileges create malicious regex patterns, these rules can be executed against user-provided inputs that match the specific unsafe patterns. The system fails to implement proper regex complexity checks or validation mechanisms that would prevent the execution of potentially dangerous regular expressions capable of causing resource exhaustion or infinite loop conditions.
From an operational perspective this vulnerability creates significant risk for system availability and stability. When properly crafted malicious strings are provided as input, the unsafe regex patterns can trigger denial of service conditions by consuming excessive computational resources or entering infinite loops that prevent normal system operations. The impact extends beyond simple service disruption to potentially affecting all users of the platform who depend on the affected functionality.
The vulnerability aligns with CWE-185 which addresses improper regular expression handling and represents a classic example of insecure input validation that can lead to resource exhaustion attacks. This weakness falls under ATT&CK technique T1499 which covers network disruption and denial of service attacks. The lack of proper regex validation in the rule creation process creates an attack surface that allows privilege-escalated attackers to compromise system availability through carefully crafted malicious patterns.
The fix implemented in version 0.6.4 addresses this vulnerability by introducing comprehensive regex validation mechanisms that prevent the creation of unsafe regular expressions. The update likely incorporates proper input sanitization checks, complexity limits, and pattern validation routines that ensure only safe regex rules can be created and executed within the system. This remediation approach aligns with industry best practices for secure regex implementation and demonstrates the importance of proper validation controls in preventing denial of service conditions through input manipulation.
Organizations using Open Mercato should prioritize updating to version 0.6.4 or later to mitigate this vulnerability while also implementing additional monitoring for suspicious regex pattern creation activities. The fix represents a critical security enhancement that restores proper input validation controls and protects against resource exhaustion attacks that could otherwise compromise system availability and user access to platform services.