Regex budget exhaustion in jsv bypasses schema validation
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
The jsv library for Erlang and Elixir, from 0.1.0 before 0.26.2, has an improper check for unusual or exceptional conditions (CWE-754) in its pattern and patternProperties keywords. Its regex helper runs schema regexes with a backtracking budget but does not report when the budget is exhausted, so an exhausted match is treated as a non-match. An unauthenticated remote attacker can send a string that matches a schema regex only after heavy backtracking, bypassing schema validation for patternProperties, additionalProperties, and not subschemas. Only schemas whose regex explores a catastrophic branch before the matching branch are affected, and the attacker controls the data, not the schema.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit. Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget. This issue affects jsv: from 0.1.0 before 0.26.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade lud jsv to version 0.26.2. The sources list no fixed version for jsv other than 0.26.2. CISA does not list this vulnerability in the Known Exploited Vulnerabilities catalog.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA jsv (lud) Fixed in 0.26.2
Timeline
- 2026-11-01 Threatist record created from CVE-2026-117680
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: LOW → MEDIUM
References
More lud vulnerabilities
- TI-2026-47095 Reflected XSS in oaskit's default HTML error handler CVSS 4.0MEDIUM 5.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences