CVE-2024-27454: orjson does not limit recursion for… – CVSS 7.5 · Watchpost

← All vulnerabilities

orjson does not limit recursion for deeply nested JSON documents

高危 7.5CVE-2024-27454 · GHSA-pwr2-4v36-6qpr · PYSEC-2024-40 · Published 26/02/2024 · updated 17/06/2026

要点

CVE-2024-27454 是影响 orjson, orjson (ijl) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.2%，高于 68.1% 的漏洞。
修复：升级到 3.9.15 或更高版本。

Package	Affected versions	Patched versions
orjson PyPI	`< 3.9.15`	`3.9.15`
orjson ijl	`< 3.9.15`	`3.9.15`

Description

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

NVD description

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

References

nvd.nist.gov/vuln/detail/CVE-2024-27454 · ADVISORY
ijl/orjson · WEB
ijl/orjson commit b0e4d2c · WEB
ijl/orjson · PACKAGE
ijl/orjson · WEB
pypa/advisory-database · WEB
monicz.dev/CVE-2024-27454 · WEB
GitHub Advisory GHSA-pwr2-4v36-6qpr · ADVISORY

orjson 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free