CVE-2025-67221: orjson Package Suffers from Unrestricted Recursion in Deeply Nested JSON Documents
Summary
CVE-2025-67221: orjson does not limit recursion for deeply nested JSON documents. Affects orjson versions < 3.11.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
orjson is a fast JSON serialization library for Python, designed to provide high performance and efficiency in converting Python objects to JSON format. It is widely used in applications that require quick data interchange and serialization. However, the library has a vulnerability that allows for unrestricted recursion when handling deeply nested JSON documents, which can lead to potential denial of service attacks.
Vulnerability Detail
The orjson.dumps function in orjson versions up to 3.11.4 does not impose limits on recursion depth for deeply nested JSON documents. This oversight can lead to excessive memory consumption and stack overflow errors, potentially crashing the application or causing denial of service. Attackers can exploit this vulnerability by crafting malicious JSON input that is deeply nested, leading to resource exhaustion and application instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to limit the depth of JSON documents before passing them to the orjson.dumps function. For example, you can create a function to check the depth of the JSON structure and raise an exception if it exceeds a certain threshold.
Conclusion
In summary, the orjson package has a vulnerability that allows for unrestricted recursion in deeply nested JSON documents, which can lead to denial of service. It is crucial to update to the latest version of orjson to mitigate this risk. Implementing input validation can also serve as a temporary workaround.
See every vulnerability recorded for orjson →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
The vulnerability affects orjson versions from 0 up to 3.11.4.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application's status using the Vulert playground without any signup.
The potential consequences include denial of service due to excessive memory usage and application crashes caused by stack overflow errors.
Yes, you can implement input validation to limit the depth of JSON documents before processing them with orjson.
References
Related vulnerabilities
Recent vulnerabilities recorded for orjson.
