AIKIDO-2025-10339

TL;DR

Affected versions of this package fail to enforce a maximum recursion depth when parsing deeply nested JSON objects, making them vulnerable to a denial-of-service (DoS) attack. The code reads JSON data from a file but lacks a max_depth parameter and proper exception handling, which could lead to excessive recursion, potentially triggering Python's recursion limit and causing the application to crash. An attacker could exploit this by submitting a maliciously crafted JSON file with extreme levels of nesting, causing the system to consume excessive CPU and memory resources or terminate unexpectedly.