lud jsv up to 0.26.1 Regex Matching JSV.Helpers.RegexExt.bounded_match? incorrect bitwise shift of integer

Summaryinfo

A vulnerability described as critical has been identified in lud jsv up to 0.26.1. This impacts the function JSV.Helpers.RegexExt.bounded_match? of the component Regex Matching. Executing a manipulation can lead to incorrect bitwise shift of integer. This vulnerability appears as CVE-2026-117680. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in lud jsv up to 0.26.1. It has been declared as critical. This vulnerability affects the function JSV.Helpers.RegexExt.bounded_match? of the component Regex Matching. The manipulation with an unknown input leads to a incorrect bitwise shift of integer vulnerability. The CWE definition for the vulnerability is CWE-1335. An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result. As an impact it is known to affect integrity, and availability. CVE summarizes:

Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit. Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget. This issue affects jsv: from 0.1.0 before 0.26.2.

The advisory is available at github.com. This vulnerability was named CVE-2026-117680 since 10/30/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 0.26.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• lud

Name

• jsv

Version

• 0.26.0
• 0.26.1

Website

• Product: https://github.com/lud/jsv/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion