CVE-2025-67221: High severity pypi/orjson vulnerability
Published Jan 22, 2026
·Updated
The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.
Affected Software
4 affected components
pypi/orjson<=3.11.4
pip/orjson<=3.11.4
Ijl Orjson Python<=3.11.4
IBM Concert Software<=1.0.0-2.2.0
Event History
Jan 22, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 PM
Affected Software
Advisory Published
via GitHub·06:30 PM
Data Sourced
via GitHub·06:30 PM
DescriptionWeaknessAffected Software
Apr 6, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-67221?
CVE-2025-67221 has been classified as a medium severity vulnerability due to potential denial of service risks from deep recursion in JSON documents.
2
How do I fix CVE-2025-67221?
To fix CVE-2025-67221, update the orjson library to a version later than 3.11.4 which includes recursion limits for nested JSON.
3
What components are affected by CVE-2025-67221?
CVE-2025-67221 affects the orjson library versions up to and including 3.11.4 used in Python applications.
4
What are the potential impacts of CVE-2025-67221?
The potential impacts of CVE-2025-67221 include application crashes or denial of service from processing excessively nested JSON data.
5
Is CVE-2025-67221 exploitable?
Yes, CVE-2025-67221 is exploitable if an attacker can craft deeply nested JSON documents that cause the application to crash.