CVE-2025-67221

What it actually does

orjson.dumps in orjson through 3.11.4 performs unbounded recursive descent when serializing JSON. A document whose object or array nesting exceeds native stack capacity can overflow the stack and abort the process. The CVSS vector is availability-only (C:N/I:N/A:H): confidentiality and integrity are not affected, but the hosting process is fully taken down until it is restarted.

Why it matters to the business

Services that serialize untrusted JSON with the affected library—including OpenTelemetry Collector Contrib FIPS on MinimOS—can be crashed, interrupting telemetry ingestion, dashboards, and alerting. That outage can also hide concurrent incidents. The CVE is not in CISA KEV, is not tied to ransomware, and has no known exploit maturity; EPSS is low (~0.006) with only a modest 9% rise over 30 days, so mass opportunistic exploitation is unlikely. It has been public for roughly 249 days, so remaining unpatched collectors are a lingering operational-availability risk rather than a new emergency.

How an attack unfolds

An unauthenticated remote attacker who can submit JSON that is later passed to orjson.dumps crafts a document with extreme nesting. When the collector or application serializes it, unbounded recursion exhausts the stack and the process dies. No privileges or user interaction are required if a network-facing path accepts and re-encodes attacker-controlled JSON. No named threat actors or campaigns are associated with this issue, and there is no public exploit maturity.

How to fix it

Upgrade opentelemetry-collector-contrib-fips (MinimOS) to 0.138.0-r1 or later, which addresses this issue. Independently, replace orjson 3.11.4 and earlier with a release that bounds recursion in dumps. As defense in depth, reject or flatten JSON above a conservative nesting limit before serialization, and run collectors under process supervision so a crash does not leave a lasting outage.

How to confirm the fix worked

Confirm the deployed MinimOS package is opentelemetry-collector-contrib-fips 0.138.0-r1 or newer and that the bundled orjson is newer than 3.11.4. Inventory other runtimes that import orjson and verify they are patched. After upgrade, submit moderately nested but policy-allowed JSON through the same serialize path and confirm the process stays up; keep production validation within safe nesting limits rather than attempting stack-exhausting inputs.

Typical attack path

1. Locate a network-reachable path that accepts attacker-controlled JSON and serializes it with orjson.dumps (for example an OpenTelemetry collector or other orjson-backed service).
2. Submit a JSON document whose object or array nesting is deep enough to exceed the process stack.
3. Cause the application to invoke orjson.dumps on that document.
4. The process overflows the stack and terminates, denying service.
5. Repeat submissions as needed to keep crash-looping the service after restarts.

How to detect it

There is no public in-the-wild exploitation, named actor activity, or ransomware use to hunt for. Look retrospectively for unexplained collector or Python-process crashes, rapid restart loops, and gaps in telemetry around the time nested JSON was ingested. Review application and supervisor logs, core dumps, and kernel logs for native stack overflow or segmentation faults in a process that loads orjson, especially during JSON serialization. Correlate those events with inbound requests carrying unusually deep JSON. Absence of these artifacts does not prove the service was never targeted; it only means a crash may not have been captured.

• orjson.dumps
• Fatal Python error: _Py_CheckRecursiveCall
• RecursionError: maximum recursion depth exceeded
• segfault.*orjson
• SIGSEGV
• opentelemetry-collector-contrib

What your security team should do

• Patch opentelemetry-collector-contrib-fips (MinimOS) to 0.138.0-r1 or later as the primary fix.
• Inventory every runtime that depends on orjson and upgrade anything still on 3.11.4 or earlier.
• Enforce a maximum JSON nesting depth at ingress so untrusted documents cannot reach dumps.
• Watch collector process crashes, restarts, and gap in telemetry as availability signals until the fleet is patched.
• Treat this as an availability hardening item, not an active KEV or ransomware-driven emergency, given none exploit maturity and low EPSS.