---
id: CVE-2026-117680
title: >-
  jsv treats regex match budget exhaustion as a non-match, bypassing
  patternProperties and not
summary: >-
  Improper Check for Unusual or Exceptional Conditions vulnerability in the
  pattern and patternProperties keywords in lud jsv allows an unauthenticated
  remote attacker to bypass schema validation via a string that matches a schema
  regex on…
severity: low
cvss: 2.1
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-754
vendor: lud
product: jsv
affected:
  - jsv >= 0.1.0 < 0.26.2
  - >-
    lud/jsv >= 302a5d0803468f81a1cf08e3b67d8b14cee759ca <
    defdb8a68ac7f218aa5dfe85190d484017cb8817
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T19:43:40.753996Z'
exploitAvailable: true
published: '2026-11-01'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T19:44:02.251Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117680'
references:
  - url: 'https://github.com/lud/jsv/security/advisories/GHSA-cvmg-hgv6-jqcp'
    label: >-
      Regex match budget exhaustion is treated as a non-match, bypassing
      `patternProperties` and `not`
  - url: 'https://cna.erlef.org/cves/CVE-2026-117680.html'
    label: EEF CNA record for CVE-2026-117680
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-117680'
    label: OSV record EEF-CVE-2026-117680
  - url: 'https://github.com/lud/jsv/commit/302a5d0803468f81a1cf08e3b67d8b14cee759ca'
    label: Introducing commit 302a5d0 in lud/jsv
  - url: 'https://github.com/lud/jsv/commit/defdb8a68ac7f218aa5dfe85190d484017cb8817'
    label: Fix commit defdb8a in lud/jsv
tags:
  - cve.org
  - exploit-available
epss: 0.00191
epssPercentile: 0.08834
ingestedAt: '2026-11-05T19:30:42.809Z'
---

## Overview

Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit.

Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget.

This issue affects jsv: from 0.1.0 before 0.26.2.

## Affected

- `jsv >= 0.1.0 < 0.26.2`
- `lud/jsv >= 302a5d0803468f81a1cf08e3b67d8b14cee759ca < defdb8a68ac7f218aa5dfe85190d484017cb8817`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Pair patternProperties with additionalProperties: false. A key whose match exhausts the budget is then rejected instead of accepted unchecked. Valid keys that need heavy backtracking are rejected as well.

Write schema regexes without nested quantifiers or overlapping alternatives, and do not express deny-lists as a not subschema with a pattern on untrusted input.