Base Score

HIGH7.5

CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

VectorNETWORK

Published Bycve@mitre.org

Published DateFeb 26, 2024, 16:28

Affected Versions(1)

orjson(PyPI)

Introduced0

Fixed3.9.15

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
orjson(PyPI)	0	3.9.15	N/A

Weakness Type (CWE):CWE-674

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

NONE

Integrity (I)

NONE

Availability (A)

HIGH

References

https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915
https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e
https://github.com/ijl/orjson/issues/458
https://monicz.dev/CVE-2024-27454

Base Score

HIGH7.5

Weakness Type (CWE):CWE-674

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

NONE

Integrity (I)

NONE

Availability (A)

HIGH