Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an…
CVE-2026-117680
Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.boundedmatch?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :reporterrors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit. Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget. This issue affects jsv: from 0.1.0 before 0.26.2.
Assessment
- CVSS
- 2.1 (v4.0)
- Severity
- Low
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 1 November 2026
- Last updated
- 1 November 2026
- Affected
- lud
- Assigner
- EEF
CVSS vectorCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
At the source
References
- https://github.com/lud/jsv/security/advisories/GHSA-cvmg-hgv6-jqcp
- https://cna.erlef.org/cves/CVE-2026-117680.html
- https://osv.dev/vulnerability/EEF-CVE-2026-117680
- https://github.com/lud/jsv/commit/302a5d0803468f81a1cf08e3b67d8b14cee759ca
- https://github.com/lud/jsv/commit/defdb8a68ac7f218aa5dfe85190d484017cb8817
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-117680