{"uuid": "06da4bce-58f5-4d17-8312-c297cee1557e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xf7x-x43h-rpqh", "type": "seen", "source": "https://gist.github.com/alon710/b44757b6afa3477e3470b6c4803062d7", "content": "# GHSA-XF7X-X43H-RPQH: GHSA-xf7x-x43h-rpqh: Denial of Service via Unconstrained Circular Reference Resolution in json-repair\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-13\n> **Full Report:** https://cvereports.com/reports/GHSA-XF7X-X43H-RPQH\n\n## Summary\nA Denial of Service vulnerability exists in the json-repair Python library due to an unconstrained loop during JSON Schema reference resolution. By submitting a circular JSON Schema, an attacker can trigger infinite recursion, causing 100 percent CPU exhaustion. Because this package is heavily utilized in LLM data-processing pipelines, this flaw presents a substantial threat to application availability.\n\n## TL;DR\nUnauthenticated remote attackers can cause denial of service (100 percent CPU exhaustion) by submitting circular JSON Schema references to the json-repair parser.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-835\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity**: 7.5 (High)\n- **EPSS Score**: 0.00045\n- **Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing python-json-repair to parse or validate schema-bounded outputs.\n- Flask/FastAPI endpoints mapping POST payloads directly to the json_repair.loads schema parameter.\n- Interactive playground applications showcasing LLM schema parsing techniques.\n- **json-repair**: < 0.60.1 (Fixed in: `0.60.1`)\n\n## Mitigation\n\n- Upgrade to json-repair version 0.60.1 or higher.\n- Sanitize and validate incoming schemas using third-party libraries before passing them to json-repair.\n- Configure strict CPU time limits and worker process execution timeouts at the application gateway level.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade json-repair' to fetch the patched version.\n2. Review codebases for instances of json_repair.loads() receiving user-controlled schemas.\n3. Enforce Gunicorn/uWSGI timeouts to terminate frozen threads automatically.\n4. Verify schema definitions dynamically via automated unit testing with cyclic schema validation rules.\n\n## References\n\n- [GitHub Advisory for GHSA-xf7x-x43h-rpqh](https://github.com/advisories/GHSA-xf7x-x43h-rpqh)\n- [Vulnerable Code Repository](https://github.com/mangiucugna/json_repair)\n- [Official Security Advisory Release Note](https://github.com/mangiucugna/json_repair/security/advisories/GHSA-xf7x-x43h-rpqh)\n- [Fixed Version Release Tag](https://github.com/mangiucugna/json_repair/releases/tag/v0.60.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-XF7X-X43H-RPQH) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-14T01:11:57.069549Z"}