{"id":"CVE-2025-67221","aliases":["GHSA-hx9q-6w63-j58v","PYSEC-2026-107"],"title":"orjson does not limit recursion for deeply nested JSON documents","summary":"orjson does not limit recursion for deeply nested JSON documents","severity":"high","vendor":"orjson","product":"orjson","ecosystem":"pip","affected":["orjson < 3.11.6"],"patched":["orjson 3.11.6"],"published":"2026-01-22","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:33.258377926Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-hx9q-6w63-j58v","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67221"},{"url":"https://github.com/ijl/orjson/issues/620"},{"url":"https://github.com/kpatsakis/CVE-2025-67221/issues/1"},{"url":"https://github.com/ijl/orjson/commit/62bb185b70785ded49c79c26f8c9781f1e6fe370"},{"url":"https://github.com/ijl/orjson"},{"url":"https://github.com/kpatsakis/orjson_vulnerability"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/orjson/PYSEC-2026-107.yaml"}],"tags":["osv","pip","exploit-available"],"epss":0.00643,"epssPercentile":0.49387,"exploits":{"github":1,"githubRepos":["https://github.com/kpatsakis/CVE-2025-67221"],"checkedAt":"2026-09-23T07:13:43.927Z"},"exploitAvailable":true,"ingestedAt":"2026-09-12T03:13:01.703Z","slug":"CVE-2025-67221","body":"## Overview\n\nThe orjson.dumps function in orjson before 3.11.6 does not limit recursion for deeply nested JSON documents.\n\n## Affected packages\n\n- `orjson < 3.11.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `orjson 3.11.6`","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}