Live › vulnerability › CVE-2026-117680
The jsv Elixir JSON Schema validator treats a regex that runs out of its backtracking budget the same as a regex that does not match, so a crafted string can slip past pattern, patternProperties, and not checks. An unauthenticated attacker who controls the data sent to a schema with a catastrophic-backtracking regex can get invalid data accepted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 14:20 UTC. All times on this page are UTC.
Only applications that use jsv to validate untrusted input against schemas containing regexes that can backtrack catastrophically. Linear patterns never exhaust the budget, and the attacker controls data rather than the schema, so applications with fixed, safe schemas or no untrusted input can skip it.
No product ranges from the sources yet.
mix.lock or mix deps and see whether it is below 0.26.2.pattern or patternProperties regexes with nested quantifiers or alternations that could backtrack heavily.jsv or later (fixed version per the source ranges: from 0.1.0 before 0.26.2)0.26.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit.
Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget.
This issue affects jsv: from 0.1.0 before 0.26.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-117680")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.