[GHSA-hx9q-6w63-j58v] orjson does not limit recursion for deeply nested JSON documents

[jrafkind-ai]

Updates

• Affected products
• CVSS v4

Comments
orjson 3.11.5 is unaffected by the reported issue

[jrafkind-ai]

I did not mean to change the severity, but the 'suggest a change' form populates the severity vector string box with invalid input, and I couldn't find a valid input it would accept.

[Copilot]

Pull request overview

This PR updates the security advisory for GHSA-hx9q-6w63-j58v (orjson recursion limit issue) to clarify affected versions and metadata. The primary intent is to mark 3.11.5 as fixed/unaffected and adjust related advisory fields.

Changes:

• Update the modified timestamp on the advisory.
• Adjust affected version information to mark 3.11.5 as fixed and add database_specific.last_known_affected_version_range.
• Clear the severity array (removing the previous CVSS v4 score).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The severity array is now empty, which drops the previously defined CVSS v4 score; this conflicts with the PR description mentioning a CVSS v4 update and results in the advisory no longer exposing any severity information. Consider restoring a CVSS_V4 entry here (with the updated vector as needed) instead of leaving the array empty so downstream consumers still receive a severity rating.

Suggested change

	"severity": [],
	"severity": [
	{
	"type": "CVSS_V4",
	"score": "5.3",
	"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
	}
	],

[jrafkind-ai]

copilot, are you able to make this change

[jrafkind-ai]

As noted here: kpatsakis/CVE-2025-67221#1, orjson is still affected if the nesting depth exceeds 127. So this is still likely an issue