PT-2026-26202 · Deepdiff · Deepdiff

Am-Periphery · Published 2026-03-18 · Updated 2026-03-26 · CVE-2026-33155

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DeepDiff versions 5.0.0 through 8.6.1

Description DeepDiff is a Python project for deep difference and search of data. The pickle unpickler RestrictedUnpickler validates which classes can be loaded but does not limit their constructor arguments. Certain types within SAFE TO IMPORT (like builtins.bytes, builtins.list, and builtins.range) have constructors that allocate memory proportional to their input. A small, 40-byte pickle payload can trigger the allocation of over 10 GB of memory, potentially crashing applications that load delta objects or use pickle load with untrusted data. This can be exploited in two ways: during pickle load by calling bytes(N) with a large N, or during delta application by manipulating values and types. The amplification factor can be significant, reaching up to 2,000,000x. This issue results in a denial of service.

Recommendations DeepDiff versions prior to 8.6.2 are affected. Update to DeepDiff version 8.6.2 or later.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-33155

GHSA-54JJ-PX8X-5W5Q

OPENSUSE-SU-2026:10417-1

SUSE-SU-2026:1094-1

Affected Products

Deepdiff

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33155.json · Exploit
• https://github.com/qlustered/deepdiff/security/advisories/GHSA-54jj-px8x-5w5q · Vendor Advisory
• https://github.com/qlustered/deepdiff/commit/0d07ec21d12b46ef4e489383b363eadc22d990fb · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:1094-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33155 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10417-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33155 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33155 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33155 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33155 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33155 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-54jj-px8x-5w5q · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33155 · Vendor Advisory
• https://github.com/seperman/deepdiff/security/advisories/GHSA-54jj-px8x-5w5q · Note
• https://github.com/seperman/deepdiff · Note