CVE-2025-67221
📋 TL;DR
CVE-2025-67221 is a denial-of-service vulnerability in orjson's dumps function that allows attackers to crash applications by providing deeply nested JSON documents that cause unbounded recursion. This affects any Python application using orjson for JSON serialization. The vulnerability can lead to service disruption and resource exhaustion.
💻 Affected Systems
- orjson
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage through application crashes, potential memory exhaustion leading to system instability, and denial-of-service affecting all users.
Likely Case
Application crashes or hangs when processing malicious JSON input, causing temporary service disruption for affected endpoints.
If Mitigated
Limited impact with proper input validation and recursion limits in place, potentially causing only isolated request failures.
🎯 Exploit Status
Exploitation requires sending specially crafted JSON with deep nesting to endpoints using orjson.dumps. No authentication needed if vulnerable endpoint is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.11.5 and later
Vendor Advisory: https://github.com/ijl/orjson/security/advisories
Restart Required: Yes
Instructions:
1. Update orjson to version 3.11.5 or later using pip: pip install --upgrade orjson>=3.11.5
2. Restart all Python applications using orjson
3. Verify the update was successful
🔧 Temporary Workarounds
Input validation wrapper
allWrap orjson.dumps calls with custom validation to limit recursion depth before serialization
def safe_dumps(obj, max_depth=1000):
# Add recursion depth checking logic
# Then call orjson.dumps if depth is safe
Rate limiting
allImplement rate limiting on JSON processing endpoints to limit impact of DoS attempts
🧯 If You Can't Patch
- Implement WAF rules to block JSON payloads with excessive nesting depth
- Use alternative JSON libraries like json or ujson for critical endpoints
🔍 How to Verify
Check if Vulnerable:
Check orjson version: python -c "import orjson; print(orjson.__version__)" and verify if <= 3.11.4Check Version:
python -c "import orjson; print('Version:', orjson.__version__)"Verify Fix Applied:
Test with a deeply nested JSON structure (1000+ levels) to ensure application doesn't crash📡 Detection & Monitoring
Log Indicators:
- Application crashes or restarts after processing JSON
- High memory usage spikes
- Stack overflow errors in logs
Network Indicators:
- Large JSON payloads with repeated nesting patterns
- Multiple rapid requests to JSON endpoints
SIEM Query:
source="application.logs" AND ("RecursionError" OR "stack overflow" OR "orjson") AND "dumps"