CVE-2024-27454

orjson does not limit recursion for deeply nested JSON documents

7.5 HighFix available

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.19%Up 1.1 points since Feb 26, 2024

What each source reports

CVE List Score used 7.5

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

Record: CVE-2024-27454
CVSS 3.1: 7.5 HighCVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
Weakness: CWE-674
Updated: 2026-11-02

EUVDEUVD-2024-0130 7.5

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

Record: EUVD-2024-0130
CVSS 3.1: 7.5 HighCVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pwr2-4v36-6qpr 7.5

orjson does not limit recursion for deeply nested JSON documents

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

Record: GHSA-pwr2-4v36-6qpr
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

NVD 7.5

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

Record: CVE-2024-27454
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

OSV 7.5

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

Record: CVE-2024-27454
CVSS 3.1: 7.5 HighCVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-27454 7.5

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

Record: DEBIAN-CVE-2024-27454
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 8 moreShow less

OSVGHSA-pwr2-4v36-6qpr 7.5

orjson does not limit recursion for deeply nested JSON documents

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

Record: GHSA-pwr2-4v36-6qpr
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

OSVROOT-APP-PYPI-CVE-2024-27454 7.5

CVE-2024-27454 in orjson - Patched by Root

Root has patched CVE-2024-27454 in the orjson package for Root:PyPI. Multiple fixed versions available.

Record: ROOT-APP-PYPI-CVE-2024-27454
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVCLSA-2026-1787140595 No score

TuxCare security update for orjson (1 CVE)

TuxCare rebuilt orjson to address 1 CVE. Fixed in 3.8.5.post2+tuxcare.

Record: CLSA-2026-1787140595
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13735-1 No score

python310-orjson-3.9.15-1.1 on GA media

These are all security issues fixed in the python310-orjson-3.9.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13735-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13780-1 No score

python310-python-rapidjson-1.16-1.1 on GA media

These are all security issues fixed in the python310-python-rapidjson-1.16-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13780-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:12024-1 No score

python313-orjson-3.11.9-1.4 on GA media

These are all security issues fixed in the python313-orjson-3.11.9-1.4 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:12024-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:12033-1 No score

python313-python-rapidjson-1.23-1.4 on GA media

These are all security issues fixed in the python313-python-rapidjson-1.23-1.4 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:12033-1
Updated: 2026-11-02

OSVPYSEC-2024-40 No score

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

Record: PYSEC-2024-40
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`orjson` PyPI	before 3.9.15	3.9.15
`orjson` TuxCare:PyPI	3.8.5 up to 3.8.5.post2+tuxcare, plus listed versions 3.8.5.post1+tuxcare	3.8.5.post2+tuxcare
`python-orjson` Debian:13	before 3.9.15-1	3.9.15-1
`python-orjson` Debian:14	before 3.9.15-1	3.9.15-1
`orjson` PyPI	before 3.9.15, plus listed versions 1.0.01.0.11.1.01.2.01.2.1 Show 45 moreShow less 1.3.01.3.12.0.02.0.12.0.102.0.112.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.3.02.4.02.5.02.5.12.5.22.6.02.6.12.6.22.6.32.6.42.6.52.6.62.6.72.6.83.0.03.0.13.0.23.1.03.1.13.1.23.2.03.2.13.2.2	3.9.15
`orjson` Root:PyPI	before 3.9.5+aikido.1	3.9.5+aikido.13.9.5+aikido.2
`python-orjson` openSUSE:Tumbleweed	before 3.11.9-1.4	3.11.9-1.4
`python-python-rapidjson` openSUSE:Tumbleweed	before 1.23-1.4	1.23-1.4

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-27454 is a high vulnerability (CVSS 7.5) in Ijl Orjson, published February 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in orjson 3.9.15.

References

Show 5 moreShow less

This page doesn't list everything

Left out here: 69 versions. The JSON record has them.