{"id":"CVE-2026-117680","kind":"vulnerability","aliases":["CVE-2026-117680"],"related":[],"title":"jsv (Elixir): regex backtracking limit lets crafted data bypass schema validation","description":"Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit.\n\nOnly schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget.\n\nThis issue affects jsv: from 0.1.0 before 0.26.2.","summary":"The jsv Elixir JSON Schema validator treats a regex that runs out of its backtracking budget the same as a regex that does not match, so a crafted string can slip past pattern, patternProperties, and not checks. An unauthenticated attacker who controls the data sent to a schema with a catastrophic-backtracking regex can get invalid data accepted.","severity":"low","cvss":2.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","json-schema","jsv","package"],"not_affected_if":["fixed-schemas","linear-regex-only","no-untrusted-input"],"how_to_check":"- Check the jsv version in `mix.lock` or `mix deps` and see whether it is below `0.26.2`.\n- Search your schemas for `pattern` or `patternProperties` regexes with nested quantifiers or alternations that could backtrack heavily.","fix":"- `jsv` `0.26.2` or later (fixed version per the source ranges: from 0.1.0 before 0.26.2)","status":"open","published_at":"2026-11-01T14:18:51+00:00","first_seen_at":"2026-11-01T14:20:23+00:00","triaged_at":"2026-11-01T14:22:12+00:00","updated_at":"2026-11-01T14:22:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-01T14:22:12Z","model":"claude-haiku-5-5","output":{"fix":"- `jsv` `0.26.2` or later (fixed version per the source ranges: from 0.1.0 before 0.26.2)","reach":"network","title":"jsv (Elixir): regex backtracking limit lets crafted data bypass schema validation","impact":"medium","summary":"The jsv Elixir JSON Schema validator treats a regex that runs out of its backtracking budget the same as a regex that does not match, so a crafted string can slip past pattern, patternProperties, and not checks. An unauthenticated attacker who controls the data sent to a schema with a catastrophic-backtracking regex can get invalid data accepted.","audience":"developers","category":"package","nicknames":[],"who_cares":["elixir","jsv","json-schema"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Invalid data passes schema validation and is accepted by the application","analyst_note":"","how_to_check":"- Check the jsv version in `mix.lock` or `mix deps` and see whether it is below `0.26.2`.\n- Search your schemas for `pattern` or `patternProperties` regexes with nested quantifiers or alternations that could backtrack heavily.","plain_action":"","needs_analyst":false,"not_affected_if":["linear-regex-only","no-untrusted-input","fixed-schemas"],"who_is_affected":"Only applications that use jsv to validate untrusted input against schemas containing regexes that can backtrack catastrophically. Linear patterns never exhaust the budget, and the attacker controls data rather than the schema, so applications with fixed, safe schemas or no untrusted input can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000737,"input_tokens":4368,"output_tokens":600,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-117680':14A,17A '-2026':13A,16A '/2':123C,190C '/3':135C '0.1.0':236C '0.26.2':238C 'accept':82B,184C 'additionalproperti':167C 'affect':215C,233C 'allow':100C 'attack':63B,104C,217C 'backtrack':4A,38B,76B,120C,129C 'branch':208C,211C 'budget':39B,130C,145C,187C,230C 'bypass':9A,106C 'call':132C 'catastroph':75B,207C 'catastrophic-backtrack':74B 'check':60B,84C,165C 'condit':89C 'control':65B,218C 'craft':7A,51B 'cve':12A,15A 'data':8A,67B,81B,220C 'default':198C 'elixir':2A,18B,26B 'erlang':196C 'error':138C 'except':88C 'exhaust':143C,228C 'exist':188C 'explor':205C 'fail':191C 'get':79B 'heavi':119C 'improp':83C 'invalid':80B 'issu':232C 'json':20B,27B 'json-schema':19B 'jsv':1A,22B,25B,99C,234C 'jsv.helpers.regexext.bounded':121C 'key':157C 'keyword':96C 'let':6A 'limit':5A,200C 'linear':225C 'lud':98C 'match':48B,113C,122C,141C,155C,159C,176C,199C,213C 'never':227C 'nomatch':149C 'non':154C 'non-match':153C 'packag':23B 'past':55B 'pattern':56B,93C,182C,226C 'patternproperti':57B,95C,161C 're.run':134C 're.run/3':133C 'real':152C 'regex':3A,32B,44B,77B,116C,126C,162C,204C 'regex.match':189C 'remot':103C 'report':137C 'return':146C 'run':34B,124C 'schema':10A,21B,28B,71B,107C,115C,125C,202C,223C 'sent':68B 'slip':54B 'string':52B,111C,174C 'subschema':179C 'treat':30B 'unauthent':62B,102C 'unusu':86C 'valid':11A,29B,108C 'via':109C 'vulner':90C 'way':194C 'whose':203C 'without':136C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use jsv to validate untrusted input against schemas containing regexes that can backtrack catastrophically. Linear patterns never exhaust the budget, and the attacker controls data rather than the schema, so applications with fixed, safe schemas or no untrusted input can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T14:18:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117680","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117680","severity":null,"published_at":"2026-11-01T14:18:51+00:00","modified_at":"2026-11-01T14:18:51+00:00","first_seen_at":"2026-11-01T14:20:23+00:00","fetched_at":"2026-11-01T14:20:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}