Cyber Resilience

CVE-2025-67221

HighPublic PoCDDoS

Published: 22 January 2026

Published
22 January 2026
Modified
12 February 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0003 8.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-67221 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Ijl Orjson. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 8.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-67221 is a vulnerability in the orjson.dumps function of the orjson library through version 3.11.4. The function does not impose limits on recursion when handling deeply nested JSON documents, potentially leading to resource exhaustion. This issue corresponds to CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for significant availability disruption.

The vulnerability can be exploited by any network-accessible attacker with low complexity, no required privileges, and no user interaction. By supplying a maliciously crafted deeply nested JSON document to orjson.dumps, an attacker can induce unbounded recursion, resulting in denial of service through excessive resource consumption and potential application crashes.

Mitigation details and patches are referenced in the official orjson repository at https://github.com/ijl/orjson and a dedicated vulnerability repository at https://github.com/kpatsakis/orjson_vulnerability. The CVE was published on 2026-01-22T17:16:01.433.

EU & UK References

Vulnerability details

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Directly enables application exhaustion DoS via crafted input triggering unbounded recursion in orjson library.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2021-47877Shared CWE-770
CVE-2026-3260Shared CWE-770
CVE-2025-66560Shared CWE-770
CVE-2025-68136Shared CWE-770
CVE-2020-37038Shared CWE-770
CVE-2025-36070Shared CWE-770
CVE-2021-47791Shared CWE-770
CVE-2021-47876Shared CWE-770
CVE-2019-25342Shared CWE-770
CVE-2026-44004Shared CWE-770

Affected Assets

ijl
orjson
≤ 3.11.4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mitigates the vulnerability by requiring timely identification, reporting, and patching of the unbounded recursion flaw in orjson versions through 3.11.4.

prevent

Requires validation of JSON inputs to reject or sanitize deeply nested structures that could trigger unbounded recursion in orjson.dumps.

preventdetect

Implements denial-of-service protections specifically against resource exhaustion attacks like the recursive JSON processing in this CVE.

References