CVE-2025-67221

CVE-2025-67221 Vulnerability Summary Field| Value ---|--- CVE ID| CVE-2025-67221 Affected Product| orjson Affected Versions| ≤ 3.11.4 Vulnerability Type| Denial of Service Uncontrolled Recursion Attack Vector| Remote if attacker controls serialized data Description A denial-of-service vulnerabili...

aiograpi has dependency on vulnerable orjson 3.11.4 (CVE-2025-67221)

Impact aiograpi 0.6.6 / 0.7.0 / 0.7.1 declared orjson==3.11.6 and later ==3.11.8 in requirements.txt but setup.py carried a hard-coded duplicate requirements = ... list that was never updated and still pinned orjson==3.11.4. When setuptools builds the source distribution it reads the metadata fro...

SUSE: Security Advisory (SUSE-SU-2026:20920-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary Maximo AI Service uses wheel-0.41.3-py3-none-any.whl, orjson-3.10.14-cp311-cp311-manylinux217x8664.manylinux2014x8664.whl, pythonmultipart-0.0.21-py3-none-any.whl, pyasn1-0.6.1.tar.gz, sentencepiece-0.2.0-cp311-cp311-manylinux217x8664.manylinux2014x8664.whl, tar-7.4.3.tgz, tar-7.5.2.tgz...

Security update for python-orjson (moderate)

openSUSE security update: security update for python-orjson ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20407-1 Rating: moderate References: bsc1257121 Cross-References: CVE-2025-67221 CVSS scores: CVE-2025-67221 SUSE : 5.9...

OPENSUSE-SU-2026:20407-1 Security update for python-orjson

This update for python-orjson fixes the following issues: - CVE-2025-67221: Fixed write outsize of allocated memory on json dump bsc1257121...

CVE-2025-67221 vulnerabilities

Vulnerabilities for packages: datadog-agent, kserve, emissary...

bugbug (>=0.0.148, <=0.0.185), label-studio (0.4.1) potentially affected by CVE-2025-67221 via orjson (2.1.3)

orjson PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.148, =0.0.185 - label-studio 0.4.1 Source cves: CVE-2025-67221 Source advisory: OSV:GHSA-HX9Q-6W63-J58V...

aaaai (>=0.1.3, <=0.3.0), act-workflow (>=4.8.2, <=4.8.399) +579 more potentially affected by CVE-2025-67221 via orjson (>=3.0.0, <=3.11.5)

orjson PYPI version =3.0.0, =0.1.3, =4.8.2, =0.1.3, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.31, =0.0.1, =0.0.2, =0.0.3, =0.2.0, =0.5.3, =0.5.5 and more Source cves: CVE-2025-67221 Source advisory: GHSA-HX9Q-6W63-J58V...

CVE-2025-67221

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents...

bugbug (>=0.0.128, <=0.0.136) potentially affected by CVE-2025-67221 via orjson (2.0.11)

orjson PYPI version 2.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.128, =0.0.136 Source cves: CVE-2025-67221 Source advisory: OSV:PYSEC-2026-107...

bugbug (>=0.0.138, <=0.0.142) potentially affected by CVE-2025-67221 via orjson (2.1.1)

orjson PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.138, =0.0.142 Source cves: CVE-2025-67221 Source advisory: OSV:PYSEC-2026-107...

bugbug (>=0.0.143, <=0.0.147) potentially affected by CVE-2025-67221 via orjson (2.1.2)

orjson PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.143, =0.0.147 Source cves: CVE-2025-67221 Source advisory: OSV:PYSEC-2026-107...

bitcoinrpc (>=0.2.1, <=0.2.2) potentially affected by CVE-2025-67221 via orjson (2.6.6)

orjson PYPI version 2.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bitcoinrpc =0.2.1, =0.2.2 Source cves: CVE-2025-67221 Source advisory: OSV:PYSEC-2026-107...

aaaai (>=0.1.3, <=0.3.0), act-workflow (>=4.8.2, <=4.8.399) +569 more potentially affected by CVE-2025-67221 via orjson (>=3.0.0, <=3.11.4)

orjson PYPI version =3.0.0, =0.1.3, =4.8.2, =0.1.3, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.31, =0.0.1, =0.0.2, =0.0.3, =0.2.0, =0.5.3, =0.3.2, =0.3.3 and more Source cves: CVE-2025-67221 Source advisory: OSV:PYSEC-2026-107...

aaaai (>=0.1.3, <=0.3.0), act-workflow (>=4.8.2, <=4.8.399) +588 more potentially affected by CVE-2025-67221 via orjson (>=2.0.11, <=3.11.5)

orjson PYPI version =2.0.11, =0.1.3, =4.8.2, =0.1.3, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.31, =0.0.1, =0.0.2, =0.0.3, =0.2.0, =0.5.3, =0.5.5 and more Source cves: CVE-2025-67221 Source advisory: MEND:CVE-2025-67221...

aaaai (>=0.1.3, <=0.3.0), act-workflow (>=4.8.2, <=4.8.399) +289 more potentially affected by CVE-2025-67221 via orjson (>=3.10.6, <=3.11.5)

orjson PYPI version =3.10.6, =0.1.3, =4.8.2, =0.1.3, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.31, =0.0.1, =0.0.4, =0.2.0, =0.1.1, =0.1.8, =0.1.31 and more Source cves: CVE-2025-67221 Source advisory: SNYK:PYTHON-ORJSON-15123465...