Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

json-repair

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5PyPIAmendedPublished

    json_repair: Circular JSON Schema $ref causes unbounded CPU DoS

    GHSA-xf7x-x43h-rpqh

    Affected
    • PyPI json-repair < 0.60.1
    Fixed in
    0.60.1· Vendor fix available
    Issue
    Circular JSON Schema $ref causes unbounded CPU DoS in jsonrepair Summary SchemaRepairer.resolveschema() in jsonrepair follows JSON Schema $ref pointers in an unbounded while loop without any cycle detection. An attacker who can supply a schema containing a self-referencing $ref (e.g., via the demo Flask API or any application that passes untrusted input to loads(..., schema=...)), can cause a worker process to spin indefinitely on CPU, resulting in a complete denial of service. No authentication is required against the public demo API. The vulnerability is confirmed reproducible at CVSS 7.5 (High). Details SchemaRepairer.resolveschema() at src/jsonrepair/schemarepair.py:184–190 resolves $ref chains using a plain while loop: resolveref() at src/jsonrepair/schemarepair.py:654–665 always resolves references relative to self.rootschema, which is initialised from the caller-supplied schema (src/jsonrepair/schemarepair.py:130). When the schema contains a circular reference such as:…

    Recommended action: Upgrade to 0.60.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →