CVE-2024-27454: 
Python vulnerability analysis and mitigation

The vulnerability (CVE-2024-27454) affects orjson before version 3.9.15, where the orjson.loads function does not implement a recursion limit for deeply nested JSON documents. This security issue was discovered and reported in February 2024 (NVD, Debian Tracker).

The vulnerability is classified as Uncontrolled Recursion (CWE-674). When processing deeply nested JSON documents, orjson.loads() would not enforce any recursion limits, potentially leading to stack overflow. The issue has a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability could cause the application to crash due to stack overflow when processing maliciously crafted deeply nested JSON documents. Unlike Python's native json module which handles deep recursion gracefully with a RecursionError, orjson would segfault on affected versions (GitHub Issue).

The vulnerability was fixed in orjson version 3.9.15 by implementing a recursion limit of 1024 levels for arrays and objects. Users should upgrade to version 3.9.15 or later to receive the fix (GitHub Changelog).