The orjson library for Python is vulnerable to a denial of service attack that can crash applications via maliciously crafted, deeply nested JSON inputs.

The vulnerability exists in the orjson.dumps function, which lacks recursion limits when parsing JSON data. An unauthenticated remote attacker can trigger a stack overflow or resource exhaustion by providing a specially crafted, deeply nested JSON payload.

Successful exploitation of this vulnerability results in an application crash, leading to a denial of service for any system relying on the affected orjson library for JSON serialization. Given the CVSS score of 7.5, this represents a significant risk to service availability, particularly for public facing APIs or data processing pipelines that accept untrusted JSON input.

Immediate Action: Update the orjson library to version 3.11.6 or later via your package manager to implement the required recursion depth limits.

Proactive Monitoring: Monitor application logs for frequent crashes or unexpected process terminations associated with serialization tasks, and alert on high memory or CPU usage spikes during JSON processing.

Compensating Controls: Implement input validation at the application layer to reject excessively deep or malformed JSON structures before they reach the orjson library.

Public Exploit Available: Yes, a public proof of concept is available via the GitHub repository at https://github.com/kpatsakis/CVE-2025-67221.

This vulnerability presents a clear risk to service uptime for any Python based application utilizing the orjson library. We strongly recommend that development teams prioritize updating to version 3.11.6 immediately to incorporate the necessary security fixes and prevent potential denial of service attacks against your infrastructure.