CVE-2026-117680
Received Received - Intake

Improper Input Validation in jsv Schema Regex

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: EEF

Description
Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit. Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget. This issue affects jsv: from 0.1.0 before 0.26.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-117680

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
lud jsv 0.1.0
lud jsv 302a5d0803468f81a1cf08e3b67d8b14cee759ca

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-117680 is an Improper Check for Unusual or Exceptional Conditions vulnerability in the lud jsv library. It involves regex match budget exhaustion where a regex that uses too much backtracking is incorrectly treated as a non-match, bypassing schema validation rules like patternProperties and not. The issue occurs because the bounded_match?/2 function uses a backtracking budget but omits error reporting, returning :nomatch instead of an error when the budget is exhausted.

Detection Guidance

This vulnerability is specific to the lud/jsv library and cannot be detected via network or system commands. Instead, check if your application uses jsv versions 0.1.0 to 0.26.1. Run commands like 'mix deps' in Elixir or inspect dependency files (mix.exs) for jsv versions within the affected range.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to bypass schema validation by crafting inputs that trigger heavy backtracking in regex patterns. This could lead to accepting invalid data that should be rejected, such as bypassing patternProperties or additionalProperties checks. The impact is low integrity, as it may allow unauthorized or malformed data to pass validation.

Compliance Impact

This vulnerability could potentially affect compliance with standards like GDPR and HIPAA by allowing unauthorized or invalid data to bypass schema validation. If exploited, it may enable the submission of malformed or malicious data that should be rejected, potentially violating data integrity requirements in these regulations.

Mitigation Strategies

Upgrade jsv to version 0.26.2 or later immediately. If upgrading is not possible, avoid using complex regex patterns with nested quantifiers and pair patternProperties with additionalProperties: false. Do not use not subschemas with patterns on untrusted input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117680. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...