Skip to content

fix: upgrade orjson to 3.11.5+ to fix CVE-2025-67221#110

Merged
gkumbhat merged 2 commits intofoundation-model-stack:mainfrom
bharatsaradagi97:cve
May 5, 2026
Merged

fix: upgrade orjson to 3.11.5+ to fix CVE-2025-67221#110
gkumbhat merged 2 commits intofoundation-model-stack:mainfrom
bharatsaradagi97:cve

Conversation

@bharatsaradagi97
Copy link
Copy Markdown
Contributor

@bharatsaradagi97 bharatsaradagi97 commented May 5, 2026

  • Upgrades orjson from >=3.10.16,<3.11 to >=3.11.5,<3.12
  • Fixes CVE-2025-67221: recursion DoS vulnerability in orjson.dumps()
  • Severity: High (CVSS 7.5)

Signed-off-by: Bharat-Bharat1 <bharat.bharat1@ibm.com>
@bharatsaradagi97
Copy link
Copy Markdown
Contributor Author

@gkumbhat could you please review/merge the PR ?

Copy link
Copy Markdown
Collaborator

@gkumbhat gkumbhat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me!

The 'all' extra does not exist in pyproject.toml, causing tox to fail.
Removed it from the extras list in tox.ini to fix the build.

Signed-off-by: Bharat-Bharat1 <bharat.bharat1@ibm.com>
@gkumbhat gkumbhat merged commit 8d331e0 into foundation-model-stack:main May 5, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants