Infinite loop Affecting json-repair package, versions [,0.60.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-JSONREPAIR-17971505
- published14 Jul 2026
- disclosed13 Jul 2026
- creditUnknown
Introduced: 13 Jul 2026
New CVE NOT AVAILABLE CWE-835 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade json-repair to version 0.60.1 or higher.
Overview
json-repair is an A package to repair broken json strings
Affected versions of this package are vulnerable to Infinite loop via the resolve_schema function. An attacker can cause the application to enter an infinite loop and exhaust CPU resources by submitting a specially crafted JSON schema containing circular $ref references.