CVE-2025-67221 orjson does not limit recursion for deeply nested JSON documents
Attackers can cause denial of service by submitting deeply nested JSON documents to the orjson.dumps function, which lacks recursion limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-67221?
CVE-2025-67221 is a high-severity denial of service vulnerability in n/a, published on 22 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.
Weakness: CWE-770
Which versions are affected by CVE-2025-67221?
3 open source packages ship an affected version, including orjson. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
orjson PyPI | All versions | 3.11.5 |
orjson PyPI | All versions | 3.11.6 |
orjson PyPI | All versions | 3.11.6 |
Linux distribution packages (4)
python-orjson SUSE:Linux Enterprise Server 16.0 | All versions | 3.10.15-160000.3.1 |
python-orjson SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 3.10.15-160000.3.1 |
python-orjson openSUSE:Leap 16.0 | All versions | 3.10.15-160000.3.1 |
python-orjson openSUSE:Tumbleweed | All versions | 3.11.5-1.1 |
Products include Ijl Orjson.
How do I fix CVE-2025-67221?
Upgrade orjson to a fixed version for your release line: 3.11.5 or 3.11.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-67221 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-67221 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as CLEANSTART-2026-LO28504, CLSA-2026-1789553842, ECHO-7f2f-e83a-5508, GHSA-hx9q-6w63-j58v, MINI-57p8-2v98-fv27, MINI-6vr6-6gqp-j48g and 10 more.