CVE-2025-67221
Published: 22 January 2026
Summary
CVE-2025-67221 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Ijl Orjson. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 8.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-67221 is a vulnerability in the orjson.dumps function of the orjson library through version 3.11.4. The function does not impose limits on recursion when handling deeply nested JSON documents, potentially leading to resource exhaustion. This issue corresponds to CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for significant availability disruption.
The vulnerability can be exploited by any network-accessible attacker with low complexity, no required privileges, and no user interaction. By supplying a maliciously crafted deeply nested JSON document to orjson.dumps, an attacker can induce unbounded recursion, resulting in denial of service through excessive resource consumption and potential application crashes.
Mitigation details and patches are referenced in the official orjson repository at https://github.com/ijl/orjson and a dedicated vulnerability repository at https://github.com/kpatsakis/orjson_vulnerability. The CVE was published on 2026-01-22T17:16:01.433.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3806
Vulnerability details
The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables application exhaustion DoS via crafted input triggering unbounded recursion in orjson library.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring timely identification, reporting, and patching of the unbounded recursion flaw in orjson versions through 3.11.4.
Requires validation of JSON inputs to reject or sanitize deeply nested structures that could trigger unbounded recursion in orjson.dumps.
Implements denial-of-service protections specifically against resource exhaustion attacks like the recursive JSON processing in this CVE.