Listen to this Post
The vulnerability in orjson arises from the dumps function not enforcing a recursion depth limit when serializing JSON data. When processing a JSON document with deeply nested structures, such as an array containing another array recursively, the function calls itself repeatedly without bound. This can lead to excessive memory usage and stack overflow, causing the Python interpreter to crash. Attackers can craft a JSON payload with thousands or millions of nested layers, which when passed to orjson.dumps, will consume all available stack space, resulting in a denial-of-service. This is particularly dangerous in web applications that use orjson for JSON serialization of user-supplied data. The lack of recursion limit is a design flaw that allows for easy exploitation without complex techniques. Similar vulnerabilities have been seen in other JSON libraries. orjson versions through 3.11.4 are affected, and users should update to a patched version once available. The moderate severity indicates that while it can cause DoS, it may not lead to remote code execution or data breach, but still poses a risk to application availability. Proper input validation and depth checking are recommended mitigations.
Platform: orjson
Version: through 3.11.4
Vulnerability: Recursion limit bypass
Severity: Moderate
date: Jan 22 2026
Prediction: TBD
What Undercode Say:
Analytics:
Showing bash commands and codes related to the blog
pip install orjson==3.11.4
import orjson data = [] for _ in range(1000000): data = [bash] orjson.dumps(data)
How Exploit:
Craft deep JSON nesting.
Protection from this CVE:
Update orjson version.
Impact:
Denial-of-service crash.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
