Full Report
Denial of Service via unsafe regex vulnerability (CVE-2026-16270) has been found in Open Mercato software.
Analysis Summary
# Vulnerability: Denial of Service via Unsafe Regex in Open Mercato
## CVE Details
- **CVE ID**: CVE-2026-16270
- **CVSS Score**: Not explicitly provided in the report (Estimated High based on DoS impact)
- **CWE**: CWE-1333 (Inefficient Regular Expression Complexity / ReDoS)
## Affected Systems
- **Products**: Open Mercato software
- **Versions**: All versions prior to 0.6.4
- **Configurations**: Systems where users have privileges to define or create regex rules/validation patterns.
## Vulnerability Description
The Open Mercato software fails to validate user-provided regular expression rules. This lack of validation allows an attacker with the necessary privileges to input an "unsafe" or "evil" regex into any field that supports pattern matching. When the system subsequently attempts to match a specific string against this complex regex, it can trigger catastrophic backtracking, leading to high CPU consumption and a Denial of Service (DoS) condition.
## Exploitation
- **Status**: Disclosed via CERT Polska (PoC status not explicitly confirmed, but technical details suggest a standard ReDoS vector).
- **Complexity**: Low (Requires the ability to input a string)
- **Attack Vector**: Network (Assuming the software interface is network-accessible)
## Impact
- **Confidentiality**: None
- **Integrity**: None
- **Availability**: High (The core vulnerability results in a Denial of Service)
## Remediation
### Patches
- The vulnerability has been addressed in **version 0.6.4**. Users are advised to upgrade to this version or newer immediately.
### Workarounds
- **Access Control**: Restrict privileges for creating or modifying regex rules to highly trusted administrators only.
- **Input Sanitization**: Manually audit existing regex rules in the database for exponential complexity patterns (e.g., grouped repetitions like `(a+)+`).
## Detection
- **Indicators of Compromise**: Unusually high CPU usage spikes on the application server triggered by specific web requests or form submissions.
- **Detection Methods**: Monitor application logs for long-running processes or timeouts related to field validation modules. Security teams can use static analysis tools to scan the application's configuration or database for patterns matching CWE-1333.
## References
- CERT Polska Advisory: hxxps[://]cert[.]pl/en/posts/2026/07/vulnerability-in-open-mercato-software/
- CVE Record: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-16270
- Mitre CWE-1333: hxxps[://]cwe[.]mitre[.]org/data/definitions/1333[.]html