Junglewise Threat Intelligence

CVE-2026-16270: Open Mercato ReDoS in custom field regex validation

CVE-2026-16270 · Severity: info · CVSS 6.9 · Published 2026-07-22

Executive brief

Open Mercato is an AI-driven framework used for building CRM and ERP business systems. A security flaw allows administrative users to input malicious validation rules (regular expressions) that can crash the system or cause severe performance slowdowns. This could lead to a service outage, preventing employees from accessing business-critical data and workflows.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Open Mercato due to a lack of validation for custom regex rules. The flaw is rooted in CWE-1333 (Inefficient Regular Expression Complexity), where the application fails to sanitize or bound regex patterns used in custom fields, business rules, and workflow triggers. An attacker with high privileges (PR:H) can submit a "catastrophic backtracking" regex pattern. When the system subsequently attempts to match a specific string against this pattern, it triggers extreme CPU consumption, leading to a Denial of Service (DoS). The fix, introduced in version 0.6.4, involves migrating to RE2JS for linear-time regex matching and implementing fail-closed validation caps.

Affected products

  • Open Mercato Open Mercato < 0.6.4

Timeline

  • 2026-05-21: patched: Fix merged in GitHub pull request #1996
  • 2026-07-22: disclosed: Vulnerability disclosed by CERT Polska
  • 2026-07-22: advisory: CVE-2026-16270 published

References