Critical Recursion Limit Vulnerability in python-orjson Package
Summary
DEBIAN-CVE-2024-27454: orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. Affects python-orjson versions < 3.9.15-1. Fixed in 3.9.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-orjson package is a high-performance JSON library for Python, designed to serialize and deserialize JSON data efficiently. It is widely used in applications that require fast JSON processing. However, prior to version 3.9.15, the package is susceptible to a vulnerability that allows for deeply nested JSON documents to cause excessive recursion, potentially leading to a denial of service.
Vulnerability Detail
The vulnerability arises from the orjson.loads function, which does not impose limits on recursion depth for deeply nested JSON documents. This oversight can lead to stack overflow errors, causing applications to crash or become unresponsive when processing maliciously crafted JSON input. The vulnerability is identified as DEBIAN-CVE-2024-27454 and affects versions before 3.9.15.
How To Fix
Minimum fixed version
3.9.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-orjsonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation to limit the depth of JSON documents being processed, although this does not fully mitigate the risk associated with the vulnerability.
Conclusion
The python-orjson package has a critical vulnerability that can lead to denial of service through excessive recursion. Users are strongly advised to update to the latest version to mitigate this risk. For those unable to update immediately, implementing input validation can serve as a temporary measure.
See every vulnerability recorded for python-orjson →
FAQ
The vulnerability allows for excessive recursion when processing deeply nested JSON documents, which can lead to application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of python-orjson prior to 3.9.15 are affected by this vulnerability.
Yes, the vulnerability has been patched in version 3.9.15-1 of the python-orjson package.
If an immediate update is not possible, consider implementing input validation to limit the depth of JSON documents processed as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-orjson.
