Executive brief
A vulnerability in the json_repair library, which is used to fix broken JSON data, can allow an attacker to crash or freeze a service. By providing a specially crafted JSON schema with circular references, an attacker can force the application into an infinite loop that consumes all available CPU resources. This results in a denial of service, making the application unavailable to legitimate users until it is manually restarted.
Technical details
The vulnerability exists in the `SchemaRepairer.resolve_schema()` method within `src/json_repair/schema_repair.py`. The component resolves JSON Schema `$ref` pointers using a `while` loop that lacks cycle detection or depth limiting. When a schema contains a self-referencing `$ref` (e.g., `{"$ref": "#/a", "a": {"$ref": "#/a"}}`), the loop never terminates. This can be triggered remotely if an application passes untrusted user input to the `schema` parameter of `json_repair.loads()`. The issue is confirmed in the project's demo Flask API, where unauthenticated users can submit malicious schemas. The vulnerability is addressed in version 0.60.1.
Affected products
- mangiucugna json-repair <= 0.59.10
Timeline
- 2026-06-03: advisory: GitHub Advisory published
- 2026-06-03: patched: Version 0.60.1 released to address the issue