CVE-2024-27454

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27454
orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915 Release Notes
https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e Patch
https://github.com/ijl/orjson/issues/458 Exploit Issue Tracking
https://monicz.dev/CVE-2024-27454 Broken Link
https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915 Release Notes
https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e Patch
https://github.com/ijl/orjson/issues/458 Exploit Issue Tracking
https://monicz.dev/CVE-2024-27454 Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:ijl:orjson:*:*:*:*:*:python:*:*
History

18 Sep 2025, 16:23

Type Values Removed Values Added
CPE cpe:2.3:a:ijl:orjson:*:*:*:*:*:python:*:*
First Time Ijl orjson
Ijl
References () https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915 - () https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915 - Release Notes
References () https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e - () https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e - Patch
References () https://github.com/ijl/orjson/issues/458 - () https://github.com/ijl/orjson/issues/458 - Exploit, Issue Tracking
References () https://monicz.dev/CVE-2024-27454 - () https://monicz.dev/CVE-2024-27454 - Broken Link

21 Nov 2024, 09:04

Type Values Removed Values Added
References () https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915 - () https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915 -
References () https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e - () https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e -
References () https://github.com/ijl/orjson/issues/458 - () https://github.com/ijl/orjson/issues/458 -
References () https://monicz.dev/CVE-2024-27454 - () https://monicz.dev/CVE-2024-27454 -

02 Aug 2024, 18:35

Type Values Removed Values Added
CWE CWE-674
Summary
  • (es) orjson.loads en orjson anterior a 3.9.15 no limita la recursividad para documentos JSON profundamente anidados.

26 Feb 2024, 16:32

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-26 16:28

Updated : 2025-09-18 16:23

NVD link : CVE-2024-27454

Mitre link : CVE-2024-27454

CVE.ORG link : CVE-2024-27454

JSON object : View

Products Affected

ijl

  • orjson
CWE
CWE-674

Uncontrolled Recursion