Jsv
Monthly
Schema validation bypass in the lud jsv JSON Schema validator (versions 0.1.0 through 0.26.1) lets an unauthenticated remote attacker slip input past `pattern`, `patternProperties`, `propertyNames` and `not` constraints. The root cause is that jsv's backtracking-limited regex helper runs :re.run/3 without :report_errors, so a PCRE match_limit exhaustion is returned as :nomatch and treated as a genuine non-match - a failed `pattern` under `not`, `anyOf`, `oneOf`, `if` or `contains` can therefore make the parent schema succeed, and a skipped `patternProperties` subschema leaves the value checked against `additionalProperties` or not at all. Exploitation is conditional: the deployed schema must already contain a regex with nested quantifiers or overlapping alternatives that forces backtracking before the matching branch, which is why the assessed vector is network-reachable but high-complexity with only low integrity impact (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:N; vendor CVSS 4.0 base 2.1); the vendor advisory publishes a proof-of-concept walkthrough, but it is not verified as working exploit code and there is no evidence of active exploitation (not in CISA KEV), with the overall priority rated monitor.
Schema validation bypass in the lud jsv JSON Schema validator (versions 0.1.0 through 0.26.1) lets an unauthenticated remote attacker slip input past `pattern`, `patternProperties`, `propertyNames` and `not` constraints. The root cause is that jsv's backtracking-limited regex helper runs :re.run/3 without :report_errors, so a PCRE match_limit exhaustion is returned as :nomatch and treated as a genuine non-match - a failed `pattern` under `not`, `anyOf`, `oneOf`, `if` or `contains` can therefore make the parent schema succeed, and a skipped `patternProperties` subschema leaves the value checked against `additionalProperties` or not at all. Exploitation is conditional: the deployed schema must already contain a regex with nested quantifiers or overlapping alternatives that forces backtracking before the matching branch, which is why the assessed vector is network-reachable but high-complexity with only low integrity impact (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:N; vendor CVSS 4.0 base 2.1); the vendor advisory publishes a proof-of-concept walkthrough, but it is not verified as working exploit code and there is no evidence of active exploitation (not in CISA KEV), with the overall priority rated monitor.