AIKIDO-2026-10933
jsonschema is vulnerable to Denial of Service (DoS)
59
Medium Risk
This Affects:
jsonschemaTL;DR
The jsonschema crate evaluates pattern and patternProperties via underlying regex and fancy-regex engines during instance validation. Certain schemas with very large bounded quantifiers (for example ^.{0,404600}$) can trigger an internal regex-engine panic when matching specific instances, aborting the host process instead of returning a validation error. Services that validate untrusted JSON Schemas or instances against attacker-influenced patterns are at risk of denial of service. Versions before 0.46.4 call catch_unwind around regex matching and map panics to RegexEngineFailure so validation fails safely.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
jsonschema is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 0.46.3.
How to fix this
Upgrade the jsonschema library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant