Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117680— jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not

Quick assessment

Affected
lud jsv
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

lud 项目中的 jsv 库在 和 关键字中存在“未对异常或特殊情况进行恰当检查”的漏洞。该漏洞允许未认证的远程攻击者通过构造一个仅在发生大量回溯后才能匹配 schema 正则表达式的字符串，从而绕过 schema 验证。 具体而言， 函数在执行 schema 正则表达式时虽然设置了回溯预算（backtracking budget），但在调用 时未传入 选项。因此，当匹配过程因耗尽预算而终止时，函数返回的 结果与真正的“不匹配”结果完全相同。这导致以下问题： 对于匹配了 正则表达式的键，系统可能未对其执行 检查，或

CVSS 2.1 · Low EPSS 0.19% · P9

Affected Version Matrix 2

VendorProduct Version RangeStatus
lud jsv 0.1.0< 0.26.2 affected
302a5d0803468f81a1cf08e3b67d8b14cee759ca< defdb8a68ac7f218aa5dfe85190d484017cb8817 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117680

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit. Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget. This issue affects jsv: from 0.1.0 before 0.26.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对因果或异常条件的不恰当检查
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
lud jsv 0.1.0 ~ 0.26.2 cpe:2.3:a:lud:jsv:*:*:*:*:*:*:*:*
lud jsv 302a5d0803468f81a1cf08e3b67d8b14cee759ca ~ defdb8a68ac7f218aa5dfe85190d484017cb8817 cpe:2.3:a:lud:jsv:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-117680

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117680

请登录查看更多情报信息。

Other References for CVE-2026-117680 (5)

IV. Related Vulnerabilities

Same vendor: lud
Same weakness: CWE-754