CVE-2025-67221: orjson uncontrolled recursion in dumps function

Executive brief

orjson is a high-performance JSON library for Python. A vulnerability in the library's data processing function allows an attacker to crash an application by providing a specially crafted, deeply nested JSON document. This can lead to a service outage, impacting the availability of any system using this library to process external data.

Technical details

The vulnerability is a stack exhaustion or resource limit issue (CWE-770) within the orjson.dumps function. Prior to version 3.11.6, the library failed to implement a recursion limit when serializing deeply nested JSON structures. An attacker can exploit this by submitting a maliciously crafted JSON document with excessive nesting levels, which may cause the process to crash or consume excessive system resources. This is reachable over the network if the application uses orjson to process untrusted user input. The issue is resolved in version 3.11.6.

Affected products

• ijl orjson < 3.11.6

Timeline

• 2026-01-22: disclosed
• 2026-01-22: advisory
• 2026-01-22: patched: Fixed in version 3.11.6

References

• https://api.github.com/users/jrafkind-ai
• https://github.com/jrafkind-ai
• https://api.github.com/users/jrafkind-ai/gists%7B/gist_id%7D
• https://api.github.com/users/jrafkind-ai/repos
• https://avatars.githubusercontent.com/u/233506486?v=4
• https://api.github.com/users/jrafkind-ai/events%7B/privacy%7D