Deeply Nested JSON Document Recursion Vulnerability in python-orjson
Summary
CVE-2024-27454: orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. Affects python-orjson across 2 version ranges.
< 3.9.15-1
< b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e
Fixed in 3.9.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-orjson is a high-performance JSON library for Python, designed to provide fast serialization and deserialization of JSON data. It is widely used in applications that require efficient handling of JSON due to its speed and simplicity. However, prior to version 3.9.15, the library had a vulnerability in the orjson.loads function that did not limit recursion for deeply nested JSON documents, potentially leading to excessive resource consumption and application crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2024-27454, arises from the orjson.loads function in python-orjson versions before 3.9.15. This function lacks a mechanism to limit recursion depth when processing deeply nested JSON documents. As a result, an attacker could craft a malicious JSON payload that, when processed, could cause a stack overflow or excessive memory usage, leading to denial of service (DoS) conditions. This vulnerability can be exploited by sending specially crafted JSON data to applications using the affected version of python-orjson, potentially impacting application availability.
How To Fix
Minimum fixed version
3.9.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-orjsonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing a JSON parsing limit in your application logic to restrict the depth of JSON documents being processed. This can be done by validating the JSON structure before passing it to orjson.loads, ensuring that it does not exceed a predefined depth limit.
Conclusion
The CVE-2024-27454 vulnerability in python-orjson poses significant risks due to its potential for causing denial of service through excessive recursion in deeply nested JSON documents. Users are strongly advised to upgrade to version 3.9.15-1 or later to mitigate these risks. Implementing additional validation can also help secure applications until an upgrade is feasible.
See every vulnerability recorded for python-orjson →
FAQ
CVE-2024-27454 is a vulnerability in the python-orjson library that allows for excessive recursion when processing deeply nested JSON documents, potentially leading to denial of service.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to analyze your manifest file.
Failing to address this vulnerability can lead to application crashes or unavailability due to denial of service attacks, especially if malicious JSON data is processed.
Yes, you can implement a JSON parsing limit in your application to restrict the depth of JSON documents processed by orjson.loads.
More information about python-orjson can be found in its official documentation on GitHub or the Python Package Index (PyPI).
References
Related vulnerabilities
Recent vulnerabilities recorded for python-orjson.
