← Back to CVE Explorer

CVE-2026-117680

Full vulnerability record from the local CVENow database.

Description

Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit. Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget. This issue affects jsv: from 0.1.0 before 0.26.2.

Severity
LOW
CVSS score
2.1 (v4.0)
Vulnerability status
Received
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-11-01 14:18:51.500000
Last modified
2026-11-01 14:18:51.500000
View original CVE JSON 
{
  "id": "CVE-2026-117680",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-11-01T14:18:51.500",
  "lastModified": "2026-11-01T14:18:51.500",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit.\n\nOnly schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget.\n\nThis issue affects jsv: from 0.1.0 before 0.26.2."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "lud",
          "product": "jsv",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "jsv",
          "cpes": [
            "cpe:2.3:a:lud:jsv:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.JSV.Helpers.RegexExt'",
            "'Elixir.JSV.Vocabulary.V202012.Validation'",
            "'Elixir.JSV.Vocabulary.V202012.Applicator'",
            "'Elixir.JSV'"
          ],
          "programFiles": [
            "lib/jsv/helpers/regex_ext.ex",
            "lib/jsv/vocabulary/v202012/validation.ex",
            "lib/jsv/vocabulary/v202012/applicator.ex",
            "lib/jsv.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.JSV.Helpers.RegexExt':'bounded_match?'/2"
            },
            {
              "name": "'Elixir.JSV.Vocabulary.V202012.Validation':validate_keyword/3"
            },
            {
              "name": "'Elixir.JSV.Vocabulary.V202012.Applicator':validate_keyword/3"
            },
            {
              "name": "'Elixir.JSV':validate/2"
            },
            {
              "name": "'Elixir.JSV':validate/3"
            }
          ],
          "repo": "https://github.com/lud/jsv",
          "packageURL": "pkg:hex/jsv",
          "versions": [
            {
              "version": "0.1.0",
              "lessThan": "0.26.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "lud",
          "product": "jsv",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "lud/jsv",
          "cpes": [
            "cpe:2.3:a:lud:jsv:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.JSV.Helpers.RegexExt'",
            "'Elixir.JSV.Vocabulary.V202012.Validation'",
            "'Elixir.JSV.Vocabulary.V202012.Applicator'",
            "'Elixir.JSV'"
          ],
          "programFiles": [
            "lib/jsv/helpers/regex_ext.ex",
            "lib/jsv/vocabulary/v202012/validation.ex",
            "lib/jsv/vocabulary/v202012/applicator.ex",
            "lib/jsv.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.JSV.Helpers.RegexExt':'bounded_match?'/2"
            },
            {
              "name": "'Elixir.JSV.Vocabulary.V202012.Validation':validate_keyword/3"
            },
            {
              "name": "'Elixir.JSV.Vocabulary.V202012.Applicator':validate_keyword/3"
            },
            {
              "name": "'Elixir.JSV':validate/2"
            },
            {
              "name": "'Elixir.JSV':validate/3"
            }
          ],
          "repo": "https://github.com/lud/jsv",
          "packageURL": "pkg:github/lud/jsv",
          "versions": [
            {
              "version": "302a5d0803468f81a1cf08e3b67d8b14cee759ca",
              "lessThan": "defdb8a68ac7f218aa5dfe85190d484017cb8817",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-117680.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/lud/jsv/commit/302a5d0803468f81a1cf08e3b67d8b14cee759ca",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/lud/jsv/commit/defdb8a68ac7f218aa5dfe85190d484017cb8817",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/lud/jsv/security/advisories/GHSA-cvmg-hgv6-jqcp",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-117680",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ]
}