EUVD-2026-47649
GHSA-gchv-qq48-9rjw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin privileges required to plant the malicious regex rule (PR:H); pure availability impact with no confidentiality or integrity effect; network-accessible trigger after rule is planted.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack.
This issue was fixed in version 0.6.4.
AnalysisAI
Denial-of-service via ReDoS in Open Mercato affects all versions prior to 0.6.4, allowing an authenticated administrator who can create custom-field regex rules to introduce catastrophic backtracking patterns that block the Node.js event loop when a crafted input string is submitted. The vulnerability affects the custom-field validation pipeline across server-side (packages/core, packages/shared) and client-side (packages/ui CrudForm) components, with confirmed exposure at the PUT /api/customers/companies endpoint. No active exploitation is recorded in CISA KEV, but a proof-of-concept was submitted as part of the CERT-PL disclosure and is referenced in the public patch PR.
Technical ContextAI
CWE-1333 (Inefficient Regular Expression Complexity) covers ReDoS - a class of algorithmic complexity attacks in which specially crafted input strings force a backtracking regex engine into exponential evaluation time. Open Mercato (CPE: cpe:2.3:a:open_mercato:open_mercato:*:*:*:*:*:*:*:*) used native JavaScript RegExp to evaluate administrator-configured custom-field validation rules at runtime without sanitizing the regex pattern itself. JavaScript's v8 RegExp engine uses a backtracking NFA that can degrade to O(2^n) on inputs designed to exploit catastrophic backtracking, such as the pattern ([0-9A-Za-z]+)* referenced in the PR. Because Node.js runs on a single-threaded event loop, a blocking regex evaluation stalls the entire server process. The fix migrates all affected surfaces - custom-field validation, business-rule MATCHES evaluation, workflow trigger filters, and cache wildcard matching - from native RegExp to RE2JS, a linear-time regex engine that eliminates backtracking, combined with enforced input length caps.
RemediationAI
Upgrade to Open Mercato version 0.6.4, which replaces native JavaScript RegExp execution in all custom-field validation paths with RE2JS, a linear-time regex engine immune to catastrophic backtracking, and enforces bounded input length caps that fail closed before regex evaluation. The upstream fix is available at https://github.com/open-mercato/open-mercato/pull/1996. Administrators should be aware that RE2JS accepts a narrower regex syntax than native JavaScript RegExp; any existing custom-field regex rules using unsupported constructs will fail closed after upgrade, potentially rejecting valid values until the pattern is updated by an administrator. If immediate patching is not possible, restrict the ability to create or modify custom-field regex rules to the smallest possible set of trusted administrators, and consider rate-limiting or request-size-limiting the API endpoints that trigger custom-field validation (such as PUT /api/customers/companies) as a partial compensating control - noting that this does not prevent a determined insider from triggering the DoS with compliant-sized payloads.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today