CVE-2024-27454: ijl orjson Uncontrolled Recursion
CVSS: 7.5v3.1HighAnalyzed
AliasesGHSA-pwr2-4v36-6qprPYSEC-2024-40DEBIAN-CVE-2024-27454CGA-3whm-m2p7-f3rpCGA-8jhj-g48q-r9xgCGA-8wf9-pjxq-jf7fopenSUSE-SU-2026:12024-1openSUSE-SU-2026:12033-1
Published 26-02-2024Last modified 02-08-2024
Vulnerability summary
CVE-2024-27454 is a high (CVSS 7.5) Uncontrolled Recursion vulnerability in ijl orjson. EPSS estimates a 1.20% chance of exploitation in the next 30 days, higher than 67.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
1.20%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 26-02-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:NSourcesAll 6 agree
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.20%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
0.00 pp
From 1.20% on 21-09-2026
21-09-202621-10-2026
EPSS score1.20%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOrjson
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- kubeflow-pipelines-visualization-server< 2.2.0-r0
- py3-orjson< 3.9.15-r0
Opensuse2 products
- python-orjson&distro=openSUSE Tumbleweed< 3.11.9-1.4
- python-python-rapidjson&distro=openSUSE Tumbleweed< 1.23-1.4
Wolfi2 products
- kubeflow-pipelines-visualization-server< 2.2.0-r0
- py3-orjson< 3.9.15-r0
Debian1 product
- python-orjson< 3.9.15-1
Ijl1 product
- orjson< 3.9.15
PyPI1 product
- orjson< b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e | < 3.9.15
6 vendors · 9 products
References
11 links
- github.com/ijl/orjsonPACKAGE
