CVE-2026-52746
Description
A flaw was found in JSONata, a JSON query and transformation language. Malicious inputs to the $toMillis function can cause excessive processing due to a vulnerability in its ISO-8601 validation. This can lead to a denial of service, making applications that use JSONata expressions unresponsive.
Statement
This vulnerability is rated as Important severity because unauthenticated remote attackers can trigger catastrophic regular expression evaluation, causing CPU exhaustion and application denial of service without requiring elevated privileges. In Red Hat environments, JSONata is typically utilized as an embedded library within applications that process or transform structured data. Exploitation is only viable if an application allows untrusted clients to supply transformation queries or pass unvalidated date strings into the evaluation engine. Applications that process only trusted, predefined transformation expressions are not vulnerable to this issue.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
