CVE-2025-67221: ijl orjson
CVSS: 7.5v3.1HighAnalyzed
AliasesSUSE-SU-2026:20920-1GHSA-hx9q-6w63-j58vPYSEC-2026-107CGA-2hvw-px4q-f8p9CGA-4ppv-78w4-h5qpCGA-4vx2-pjxw-237hCGA-69vx-84g9-4qcwCGA-6q4v-g8pc-f69mCGA-7j8h-cx58-95pfCGA-7v5g-7xfq-7ppxCGA-96rr-hv34-5jm9CGA-9gp3-4h7x-7rv9CGA-f66w-v7jm-wrh2CGA-j5v7-295v-hc66CGA-jjcp-cqm6-xq4vCGA-jxfv-wpqq-9jj2CGA-qm7g-8629-h9j3CGA-qx2w-ccj3-v695CGA-r84c-hm2r-5x9xCGA-rgm5-9q4m-qmx4CGA-v484-p8w7-5x44openSUSE-SU-2026:10103-1openSUSE-SU-2026:20407-1CGA-2r93-wm4j-cv34CGA-32xw-qmh6-ph6cCGA-3jvp-g9jc-4fc4CGA-44xg-wm3g-m22pCGA-73p2-vw2p-rh49CGA-7r2j-gp89-9fvfCGA-862f-rr87-xxqfCGA-87fg-m5h6-7cpjCGA-8m8r-82cf-hxwmCGA-8v9m-3fh9-6q9rCGA-9gp4-fg88-wx2gCGA-f2mh-83wf-jf5jCGA-ffvh-9g8c-mjv3CGA-hg2w-gw3v-h3fqCGA-hpwj-hh6v-62ppCGA-hq27-mg76-4pq7CGA-j6fg-m9q5-fqw4CGA-mcrc-93r6-92jg
Published 22-01-2026Last modified 22-01-2026
Vulnerability summary
CVE-2025-67221 is a high (CVSS 7.5) vulnerability in ijl orjson. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.63%
0%100%
Low · -0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 22-01-2026PublishedVulnerability first disclosed.
- 22-01-2026Last modifiedVulnerability information updated.
Description
The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
-0.01 pp
From 0.64% on 20-09-2026
20-09-202620-10-2026
EPSS score0.63%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOrjson Vulnerability
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard18 products
- authentik< 2026.2.1-r4
- authentik-fips< 2026.2.1-r3
- datadog-agent-7.71-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.72-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.73-core-integrations< 7.73.3-r23
Wolfi9 products
- datadog-agent-7.72-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.73-core-integrations< 7.73.3-r23
- datadog-agent-7.74-core-integrations< 7.74.1-r24
- datadog-agent-7.75-core-integrations< 7.75.4-r2
- kserve-storage-controller< 0.16.0-r11
Opensuse2 products
- python-orjson&distro=openSUSE Leap 16.0< 3.10.15-160000.3.1
- python-orjson&distro=openSUSE Tumbleweed< 3.11.5-1.1
Suse2 products
- python-orjson&distro=SUSE Linux Enterprise Server 16.0< 3.10.15-160000.3.1
- python-orjson&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 3.10.15-160000.3.1
Ijl1 product
- orjson≤ 3.11.4
PyPI1 product
- orjson< 3.11.6 | < 3.11.5
6 vendors · 33 products
