Read the docs
TI-2026-83620 Aliases CVE-2026-117680

Regex budget exhaustion in jsv bypasses schema validation

Priority MEDIUM 44CWE-754Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The jsv library for Erlang and Elixir, from 0.1.0 before 0.26.2, has an improper check for unusual or exceptional conditions (CWE-754) in its pattern and patternProperties keywords. Its regex helper runs schema regexes with a backtracking budget but does not report when the budget is exhausted, so an exhausted match is treated as a non-match. An unauthenticated remote attacker can send a string that matches a schema regex only after heavy backtracking, bypassing schema validation for patternProperties, additionalProperties, and not subschemas. Only schemas whose regex explores a catastrophic branch before the matching branch are affected, and the attacker controls the data, not the schema.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit. Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget. This issue affects jsv: from 0.1.0 before 0.26.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Fix Fixed jsv (lud): 0.26.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ludjsv0.1.0 to before 0.26.20.26.2Patch availableCNA
  • jsv Vendorlud Affected 0.1.0 to before 0.26.2 Fixed in 0.26.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:lud:jsv:*:*:*:*:*:*:*:*——lud
  • cpe:2.3:a:lud:jsv:*:*:*:*:*:*:*:* Versions — — ·lud

Remediation

Upgrade lud jsv to version 0.26.2. The sources list no fixed version for jsv other than 0.26.2. CISA does not list this vulnerability in the Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA jsv (lud) Fixed in 0.26.2

Timeline

  1. 2026-11-01 Threatist record created from CVE-2026-117680
  2. 2026-11-02 CISA SSVC decision points changed
  3. 2026-11-02 Priority changed: LOW → MEDIUM

References

  • TI-2026-47095 Reflected XSS in oaskit's default HTML error handler CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences