lud jsv CVE-2026-117680

Exploitation requires the application's jsv schema (jsv 0.1.0 before 0.26.2) to contain a pattern or patternProperties regex that PCRE can only match after exploring a catastrophic branch first - specifically nested quantifiers or overlapping alternatives such as ^(?:(a+)+b|a+!)$; linear patterns never exhaust the 10_000 + 50 * byte_size budget and are unaffected. The bypass is security-relevant only where that regex gates untrusted input via not, anyOf, oneOf, if, contains, or patternProperties (worst case when patternProperties is not paired with additionalProperties: false). No authentication is required (PR:N) and the attacker controls the validated data but not the schema; the key limiting factor is that a vulnerable schema definition must already be present, so default or linear-regex schemas are not exposed.

Low, conditional risk. The input assigns CVSS 2.1 and a vuln.today decision label of 'monitor', with no EPSS score supplied and no CISA KEV listing, so there is no signal of active exploitation - a detailed proof-of-concept is described in the GHSA advisory but it is a documented reproduction, not verified packaged exploit code. The signals are largely consistent in pointing to a low-priority issue, but there is one notable conflict: the supplied CVSS 4.0 vector uses AV:L (local), whereas the description explicitly calls this an 'unauthenticated remote attacker' who 'controls the data' - the attack vector is better characterized as network (AV:N), so the provided vector likely understates reach while the AT:P (attack requirement present) correctly captures that a specially-shaped schema must already exist. PR:N confirms no authentication is needed. Real-world impact is a schema-validation bypass with limited integrity effect (VI:L; confidentiality and availability unaffected), and it only bites applications that both use jsv and define a security-relevant deny-list via not/pattern or patternProperties over a regex with catastrophic backtracking - the attacker cannot supply the schema. This is a genuine but narrow correctness/validation-bypass bug, not a high-urgency emergency; patch when convenient as the vendor fix is available.

An application validates untrusted JSON with jsv using a schema whose patternProperties or not regex contains nested quantifiers or overlapping alternatives (e.g. ^(?:(a+)+b|a+!)$). A remote unauthenticated attacker pads an input string (about twenty repeated characters) so PCRE exhausts the backtracking budget on the catastrophic branch before reaching the branch that would match; :re.run/3 returns :nomatch, the engine treats the matching value as a non-match, and the subschema is skipped or the not deny-list is bypassed, so data the schema should reject is accepted. A working PoC is documented in the GHSA advisory but is not verified as packaged exploit code.