VulnerabilityDeferred

CVE-2026-16270

An attacker with privileges to create the regex rule can add an unsafe regex to a field.

MEDIUM 6.9EPSS 0.48%

Does this matter?

Lower severity and a low EPSS score (0.48%). Track it; it rarely justifies an emergency change on its own.

Description

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.48% probability · 40th percentile
CISA KEV: Not listed
Weakness: CWE-1333
Source: cvd@cert.pl

References

https://cert.pl/posts/2026/07/CVE-2026-16270
https://github.com/open-mercato/open-mercato/pull/1996
https://www.openmercato.com/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.