CVE-2026-117680

Overview

Improper check for unusual or exceptional conditions in the pattern and patternProperties keywords of the lud jsv library allows an unauthenticated remote attacker to bypass schema validation by exploiting backtracking budget exhaustion. This can lead to acceptance of malicious data that would otherwise be rejected. The vulnerability affects jsv versions 0.1.0 through 0.26.2.

Description

Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit. Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget. This issue affects jsv: from 0.1.0 before 0.26.2.

Impact

Confidentiality: attackers can inject data that bypasses validation, potentially exposing sensitive information. Integrity: malicious data may be accepted as valid, compromising application logic. Availability: heavy backtracking could cause performance degradation. Defenders: developers using jsv for data validation.

Remediation

Upgrade to jsv 0.26.2 or later. If upgrading is not immediately possible, review and simplify regex patterns in schemas to avoid catastrophic backtracking. Configure :re.run with :report_errors or use alternative validation libraries that enforce stricter backtracking limits.

Risk context

Low severity, CVSS v4 score 2.1 indicates minimal impact. No EPSS data available. Defenders should still patch as part of routine maintenance.

Affected products

• lud jsv
• jsv
• Erlang JSON Schema Validator