Executive brief
orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.
Affected products
- PyPI orjson
Junglewise Threat Intelligence
CVE-2024-27454: PYSEC-2024-40 - orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.
CVE-2024-27454 · Severity: low · CVSS 3.1 · Published 2024-02-26
Vendors: PyPI.