CVE-2026-16270 ReDoS in Open Mercato
An attacker with privileges can inject unsafe regex rules in Open Mercato, causing a denial of service when specific strings are processed.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16270?
CVE-2026-16270 is a medium-severity denial of service vulnerability in Open Mercato, published on 22 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack.
This issue was fixed in version 0.6.4.
Weakness: CWE-1333
Which versions are affected by CVE-2026-16270?
How do I fix CVE-2026-16270?
No fix has been published for CVE-2026-16270 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-16270 being exploited?
There is no known exploitation of CVE-2026-16270 in the wild and no public exploit code.
Sources
Also known as GHSA-gchv-qq48-9rjw.