A denial of service vulnerability exists in the json_repair library before version 0.60.1 due to unbounded CPU consumption caused by circular JSON Schema $ref references. The function resolve_schema() follows $ref pointers in an unbounded loop without cycle detection, allowing an attacker to supply a self-referencing schema that causes an infinite loop. This vulnerability is exploitable without authentication via the demo Flask API. The issue results in a high-severity denial of service by exhausting CPU resources indefinitely.