CVE-2026-33155: 
Python vulnerability analysis and mitigation

CVE-2026-33155 is a memory exhaustion denial-of-service vulnerability in the Python deepdiff library, specifically in its _RestrictedUnpickler deserialization component. The vulnerability affects deepdiff versions 5.0.0 through 8.6.1 and was disclosed on March 18, 2026, with a patch released in version 8.6.2. A 40-byte crafted pickle payload can force 10+ GB of memory allocation, crashing any application that deserializes delta objects or calls pickle_load with untrusted input. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption), CWE-502 (Deserialization of Untrusted Data), and CWE-770 (Allocation of Resources Without Limits or Throttling). The _RestrictedUnpickler.find_class method validates which classes can be loaded via an allowlist (SAFE_TO_IMPORT), but does not intercept REDUCE opcodes or restrict constructor arguments — meaning allowlisted types like builtins.bytes, builtins.list, and builtins.range can be called with arbitrarily large integer arguments. Exploitation occurs via two paths: (1) a direct pickle_load call where a pickle payload invokes bytes(10**10) to allocate ~9.3 GB during deserialization, and (2) a delta application path where _do_values_changed() sets a large integer value before _do_type_changes() converts it to bytes with no size guard at delta.py:576. No authentication or special privileges are required; the attacker only needs to supply a malicious serialized payload to an exposed endpoint (GitHub Advisory, Patch Commit).

Successful exploitation causes a denial-of-service crash of any application that deserializes untrusted delta objects or calls pickle_load with external input, including services exposed via network APIs, file upload handlers, and message queue consumers. The amplification factor is extreme — up to 800,000x for the delta path and 2,000,000x for the raw pickle path — meaning a 42-byte payload can trigger ~95 MB of allocation in a memory-limited environment, and a full payload can exhaust 9.3+ GB. There is no confidentiality or integrity impact; the vulnerability is purely an availability risk, but the ease of triggering it makes it highly effective for service disruption (GitHub Advisory).

A public proof-of-concept (PoC) Python script is available in the GitHub Security Advisory, demonstrating both exploitation paths with concrete payloads and expected output (GitHub Advisory). The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.042% (0.026% per GitHub Advisory), indicating low but non-zero probability of near-term exploitation. The vulnerability is not currently listed in the CISA KEV catalog.

1. Identify target: Locate applications using deepdiff versions 5.0.0–8.6.1 that accept serialized delta objects or call pickle_load with externally supplied data (e.g., REST APIs, file upload endpoints, message queue consumers).
2. Craft raw pickle payload (Path 1): Construct a 42-byte pickle payload that invokes bytes(N) with a large integer via allowlisted opcodes:

payload = (
    b"(dp0\n"
    b"S'_'\n"
    b"cbuiltins\nbytes\n"
    b"(I10000000000\n"
    b"tR"
    b"s."
)

3. Craft delta payload (Path 2): Alternatively, construct a valid diff dict that first sets a large integer via values_changed, then triggers a type conversion to bytes via type_changes:

payload_dict = {
    'values_changed': {"root['x']": {'new_value': 10**10}},
    'type_changes': {"root['x']": {'new_type': bytes}},
}
payload = pickle_dump(payload_dict)

4. Submit payload: Send the crafted payload to the target application's deserialization endpoint (e.g., HTTP POST body, message queue message, file upload).
5. Trigger memory exhaustion: The application's pickle_load or Delta() call processes the payload, allocating 9.3+ GB of memory, causing a MemoryError or OOM kill that crashes the service (GitHub Advisory).

• Logs: Sudden MemoryError exceptions or OOM kill events in application logs coinciding with deserialization operations; Python tracebacks referencing deepdiff/serialization.py pickle_load or delta.py Delta.add().
• Process: Rapid spike in process memory consumption by the Python application process immediately before a crash; repeated application restarts or watchdog-triggered restarts.
• Network: Unusually small inbound payloads (40–200 bytes) to endpoints that accept serialized delta objects or pickle data, particularly if followed by service unavailability.
• File System: Unexpected core dump files generated by the application process following memory exhaustion events.

Upgrade deepdiff to version 8.6.2 or later, which wraps size-sensitive constructors (bytes, bytearray) in a _SafeConstructor class that rejects allocations exceeding 128 MB, preventing the REDUCE opcode abuse (Patch Commit). If immediate patching is not possible, avoid deserializing delta objects or calling pickle_load with any data from untrusted sources — network APIs, file uploads, or message queues. Additionally, implement process-level memory limits (e.g., via ulimit or container resource constraints) as a defense-in-depth measure to reduce the blast radius of exploitation (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher am-periphery (affiliated with Periphery Security), who also published a technical blog post titled "CVE-2026-33155 — 40 Bytes to Chaos" detailing the exploitation mechanics (Periphery Security Blog). Red Hat tracked the issue as medium severity in their Bugzilla system, and SUSE issued security updates for their distributions. The vulnerability received coverage on security aggregators including VulDB and InfinitSec, and was discussed on Bluesky and Mastodon/Infosec.exchange. Community reaction highlighted the irony that the restricted unpickler — introduced to make deserialization safe — still permitted resource exhaustion despite blocking remote code execution.