Attack Chain

1. An unauthenticated attacker sends an HTTP POST request to a web application endpoint (e.g., /api/repair-json in the demo Flask API) that accepts user-controlled JSON input.
2. The request body contains a specially crafted JSON payload that includes a schema field with a circular $ref definition, such as {"$ref": "#/definitions/a", "definitions": {"a": {"$ref": "#/definitions/a"}}}.
3. The vulnerable application extracts the user-provided schema from the HTTP request body and passes it directly to the json_repair.loads() function for processing.
4. Internally, json_repair.loads() instantiates a SchemaRepairer object and calls its is_valid() method, which subsequently invokes the SchemaRepairer.resolve_schema() function.
5. Within SchemaRepairer.resolve_schema(), a while loop attempts to resolve the $ref chain without any cycle detection. Due to the circular $ref, the internal _resolve_ref() function continuously returns the same dictionary object.
6. The while loop never terminates, leading to an unbounded consumption of CPU resources by the application's worker process.
7. This indefinite CPU spin causes the affected worker process to hang indefinitely, making the application unresponsive and inaccessible.
8. The consequence is a complete Denial of Service for other legitimate users attempting to access the service.

Impact

This vulnerability results in an unauthenticated denial-of-service condition affecting any application that utilizes the json_repair library and exposes json_repair.loads(..., schema=<user-controlled>) to untrusted input. A single malicious HTTP request carrying a circular $ref schema can cause a Flask worker process (or similar) to consume CPU indefinitely. This makes the service unresponsive and unavailable, requiring manual intervention such as killing the hung process or restarting the server. The attack requires no special privileges and deterministically reproduces the service disruption, though it does not affect data confidentiality or integrity.

Recommendation

• Patch the json_repair library to version 0.60.1 or higher immediately to address the identified vulnerability.
• Implement strict input validation and sanitize all user-supplied JSON schemas before passing them to json_repair.loads() with the schema parameter, specifically checking for circular $ref definitions to prevent the infinite loop.