CVE-2026-33155: DeepDiff Memory Exhaustion DoS via Unsafe Pickle Handling
Summary
CVE-2026-33155: DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT. Affects deepdiff versions >= 5.0.0, < 8.6.2. Fixed in 8.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DeepDiff is a Python library that provides deep comparison of complex data structures, allowing users to identify differences between them. It is widely used for tracking changes in data, especially in applications that require data integrity and version control. However, DeepDiff has a vulnerability that can lead to memory exhaustion, making it susceptible to denial of service attacks when handling untrusted serialized data.
Vulnerability Detail
The vulnerability arises from the _RestrictedUnpickler class in DeepDiff, which allows certain classes to be loaded without properly validating their constructor arguments. This oversight can be exploited by crafting a malicious pickle payload that allocates excessive memory during deserialization. Specifically, classes like builtins.bytes and builtins.list can be invoked with large arguments, leading to memory consumption that can crash applications. The issue is exacerbated by the fact that the restricted unpickler does not intercept REDUCE opcodes, allowing attackers to bypass safety checks and cause significant resource exhaustion.
How To Fix
Minimum fixed version
8.6.2
This is the first release that contains the fix.
pip install --upgrade "deepdiff==8.6.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid deserializing pickle data from untrusted sources. If you must handle such data, consider implementing additional checks or using alternative serialization methods that do not allow arbitrary code execution or excessive memory allocation.
Conclusion
The vulnerability CVE-2026-33155 in DeepDiff poses a significant risk of memory exhaustion through unsafe handling of pickle data. Users are urged to update to the latest version to mitigate this risk and to exercise caution when dealing with untrusted data sources.
See every vulnerability recorded for deepdiff →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is denial of service, where an attacker can crash applications by exploiting the memory exhaustion issue.
Versions of DeepDiff up to and including 8.6.1 are affected by this vulnerability.
It is recommended to avoid using DeepDiff with untrusted serialized data. If necessary, implement strict validation and use safer serialization methods.
References
Related vulnerabilities
Recent vulnerabilities recorded for deepdiff.
