diff --git a/advisories/github-reviewed/2026/01/GHSA-hx9q-6w63-j58v/GHSA-hx9q-6w63-j58v.json b/advisories/github-reviewed/2026/01/GHSA-hx9q-6w63-j58v/GHSA-hx9q-6w63-j58v.json index a57de69c2d1a2..8b85296bcbac8 100644 --- a/advisories/github-reviewed/2026/01/GHSA-hx9q-6w63-j58v/GHSA-hx9q-6w63-j58v.json +++ b/advisories/github-reviewed/2026/01/GHSA-hx9q-6w63-j58v/GHSA-hx9q-6w63-j58v.json @@ -7,11 +7,11 @@ "CVE-2025-67221" ], "summary": "orjson does not limit recursion for deeply nested JSON documents", - "details": "The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.", + "details": "The orjson.dumps function in orjson thru 3.11.5 does not limit recursion for deeply nested JSON documents.", "severity": [ { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "affected": [ @@ -28,11 +28,14 @@ "introduced": "0" }, { - "last_affected": "3.11.4" + "fixed": "3.11.6" } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.11.5" + } } ], "references": [ @@ -61,7 +64,7 @@ "cwe_ids": [ "CWE-770" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-01-22T18:55:43Z", "nvd_published_at": "2026-01-22T17:16:01Z"