CVE-2025-67221: orjson does not limit recursion for… – CVSS 7.5 · Watchpost

← All vulnerabilities

orjson does not limit recursion for deeply nested JSON documents

高危 7.5CVE-2025-67221 · GHSA-hx9q-6w63-j58v · PYSEC-2026-107 · Published 22/01/2026 · updated 17/06/2026

要点

CVE-2025-67221 是影响 orjson, orjson (ijl) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.63%，高于 50.6% 的漏洞。
修复：升级到 3.11.5, 3.11.6 或更高版本。

Package	Affected versions	Patched versions
orjson PyPI	`< 3.11.5< 3.11.6`	`3.11.53.11.6`
orjson ijl	`≤ 3.11.4`	No fix yet

Description

The orjson.dumps function in orjson before 3.11.6 does not limit recursion for deeply nested JSON documents.

NVD description

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

References

nvd.nist.gov/vuln/detail/CVE-2025-67221 · ADVISORY
ijl/orjson · WEB
kpatsakis/CVE-2025-67221 · WEB
ijl/orjson commit 62bb185 · WEB
ijl/orjson · PACKAGE
kpatsakis/orjson_vulnerability · WEB
pypa/advisory-database · WEB
GitHub Advisory GHSA-hx9q-6w63-j58v · ADVISORY

orjson 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free