PT-2026-3955

CVE-2025-67221

·

Published

2026-01-22

·

Updated

2026-10-12

Description by

CVSS 4.0
7.7
High
MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Name of the Vulnerable Software and Affected Versions orjson versions through 3.11.4
Description The orjson.dumps function does not limit recursion when processing deeply nested JSON documents. This can lead to a denial of service.
Recommendations Update to a version of orjson newer than 3.11.4.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-770: Allocation of Resources Without Limits or Throttling
Related identifiers
CVE-2025-67221
GHSA-HX9Q-6W63-J58V
CLEANSTART-2026-LO28504
ECHO-7F2F-E83A-5508
OPENSUSE-SU-2026:10103-1
OPENSUSE-SU-2026:20407-1
PYSEC-2026-107
SUSE-SU-2026:20920-1
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com