[GHSA-hx9q-6w63-j58v] orjson does not limit recursion for deeply nested JSON documents

[jrafkind-ai]

Updates

• Affected products
• CVSS v4

Comments
orjson 3.11.5 is unaffected by the reported issue

[jrafkind-ai]

I did not mean to change the severity, but the 'suggest a change' form populates the severity vector string box with invalid input, and I couldn't find a valid input it would accept.

[Copilot]

Pull request overview

This PR updates the security advisory for GHSA-hx9q-6w63-j58v (orjson recursion limit issue) to clarify affected versions and metadata. The primary intent is to mark 3.11.5 as fixed/unaffected and adjust related advisory fields.

Changes:

• Update the modified timestamp on the advisory.
• Adjust affected version information to mark 3.11.5 as fixed and add database_specific.last_known_affected_version_range.
• Clear the severity array (removing the previous CVSS v4 score).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The severity array is now empty, which drops the previously defined CVSS v4 score; this conflicts with the PR description mentioning a CVSS v4 update and results in the advisory no longer exposing any severity information. Consider restoring a CVSS_V4 entry here (with the updated vector as needed) instead of leaving the array empty so downstream consumers still receive a severity rating.

Suggested change

	"severity": [],
	"severity": [
	{
	"type": "CVSS_V4",
	"score": "5.3",
	"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
	}
	],

[jrafkind-ai]

copilot, are you able to make this change

[jrafkind-ai]

As noted here: kpatsakis/CVE-2025-67221#1, orjson is still affected if the nesting depth exceeds 127. So this is still likely an issue

[shelbyc]

@jrafkind-ai Thank you for your follow up comment about orjson still being affected. I'm going to leave the vulnerable version range as it currently is but will add ijl/orjson#620 and kpatsakis/CVE-2025-67221#1 as references for people who want to read more about the issue and a possible fix.

[advisory-database]

Hi @jrafkind-ai! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!