CVE-2025-67221

orjson does not limit recursion for deeply nested JSON documents

7.5 HighPublic exploitFix available

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.63%Up 0.6 points since Jan 23, 2026

What each source reports

CVE List Score used 7.5

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

Record: CVE-2025-67221
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

EUVDEUVD-2026-3806 7.5

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

Record: EUVD-2026-3806
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hx9q-6w63-j58v 7.7

orjson does not limit recursion for deeply nested JSON documents

The orjson.dumps function in orjson before 3.11.6 does not limit recursion for deeply nested JSON documents.

Record: GHSA-hx9q-6w63-j58v
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Weakness: CWE-770
Updated: 2026-11-02

NVD 7.5

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

Record: CVE-2025-67221
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSV 7.5

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

Record: CVE-2025-67221
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-hx9q-6w63-j58v 7.7

orjson does not limit recursion for deeply nested JSON documents

The orjson.dumps function in orjson before 3.11.6 does not limit recursion for deeply nested JSON documents.

Record: GHSA-hx9q-6w63-j58v
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Weakness: CWE-770
Updated: 2026-11-02

Show 6 moreShow less

OSVPYSEC-2026-107 7.5

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

Record: PYSEC-2026-107
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-APP-PYPI-CVE-2025-67221 5.5

CVE-2025-67221 in orjson - Patched by Root

Root has patched CVE-2025-67221 in the orjson package for Root:PyPI. Multiple fixed versions available.

Record: ROOT-APP-PYPI-CVE-2025-67221
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVCLSA-2026-1789553842 No score

TuxCare security update for orjson (1 CVE)

TuxCare rebuilt orjson to address 1 CVE. Fixed in 3.8.5.post3+tuxcare.

Record: CLSA-2026-1789553842
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10103-1 No score

python311-orjson-3.11.5-1.1 on GA media

These are all security issues fixed in the python311-orjson-3.11.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10103-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20407-1 No score

Security update for python-orjson

This update for python-orjson fixes the following issues:

CVE-2025-67221: Fixed write outsize of allocated memory on json dump (bsc#1257121).

Record: openSUSE-SU-2026:20407-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20920-1 No score

Security update for python-orjson

This update for python-orjson fixes the following issues:

CVE-2025-67221: Fixed write outsize of allocated memory on json dump (bsc#1257121).

Record: SUSE-SU-2026:20920-1
Updated: 2026-11-02

Affected products

ijl orjson

Affected packages

Affected packages
Package	Affected	Fixed
`orjson` PyPI	before 3.11.6	3.11.6
`orjson` TuxCare:PyPI	3.8.5 up to 3.8.5.post3+tuxcare, plus listed versions 3.8.5.post1+tuxcare3.8.5.post2+tuxcare	3.8.5.post3+tuxcare
`orjson` PyPI	before 3.11.6, plus listed versions 1.0.01.0.11.1.01.2.01.2.1 Show 45 moreShow less 1.3.01.3.12.0.02.0.12.0.102.0.112.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.3.02.4.02.5.02.5.12.5.22.6.02.6.12.6.22.6.32.6.42.6.52.6.62.6.72.6.83.0.03.0.13.0.23.1.03.1.13.1.23.10.03.10.13.10.10	3.11.6
`orjson` PyPI	before 3.11.5, plus listed versions 1.0.01.0.11.1.01.2.01.2.1 Show 45 moreShow less 1.3.01.3.12.0.02.0.12.0.102.0.112.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.3.02.4.02.5.02.5.12.5.22.6.02.6.12.6.22.6.32.6.42.6.52.6.62.6.72.6.83.0.03.0.13.0.23.1.03.1.13.1.23.10.03.10.13.10.10	3.11.5
`orjson` Root:PyPI	before 3.9.5+aikido.1	3.9.5+aikido.13.10.18+aikido.23.10.7+aikido.23.11.4+aikido.23.11.5+aikido.23.9.15+aikido.13.10.11+aikido.33.9.15+aikido.23.10.7+aikido.33.10.11+aikido.43.10.7+aikido.43.9.15+aikido.33.10.7+aikido.53.10.18+aikido.33.9.15+aikido.43.10.11+aikido.53.11.4+aikido.33.11.5+aikido.33.10.11+aikido.63.10.18+aikido.43.11.5+aikido.43.11.4+aikido.43.9.15+aikido.53.9.5+aikido.23.10.7+aikido.6
`python-orjson` SUSE:Linux Enterprise Server 16.0	before 3.10.15-160000.3.1	3.10.15-160000.3.1
`python-orjson` SUSE:Linux Enterprise Server for SAP applications 16.0	before 3.10.15-160000.3.1	3.10.15-160000.3.1
`python-orjson` openSUSE:Tumbleweed	before 3.11.5-1.1	3.11.5-1.1
`python-orjson` openSUSE:Leap 16.0	before 3.10.15-160000.3.1	3.10.15-160000.3.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	kpatsakis/CVE-2025-67221	2025-12-01

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-67221 is a high vulnerability (CVSS 7.5) in Ijl Orjson, published January 22, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in orjson 3.11.6.

References

Show 6 moreShow less

This page doesn't list everything

Left out here: 189 versions. The JSON record has them.