CVE-2026-33155: DeepDiff Pickle DoS Vulnerability

CVE-2026-33155 Overview

CVE-2026-33155 is a Resource Exhaustion vulnerability affecting DeepDiff, a Python library used for computing deep differences and searching within Python data structures. The vulnerability exists in the _RestrictedUnpickler class which, while validating allowed classes for deserialization, fails to restrict constructor arguments for types in the SAFE_TO_IMPORT list. This oversight allows attackers to craft malicious pickle payloads that force excessive memory allocation, leading to denial of service conditions.

Critical Impact
A compact 40-byte pickle payload can force the allocation of 10+ GB of memory, crashing applications that process untrusted delta objects or call pickle_load with attacker-controlled data.

Affected Products

DeepDiff versions 5.0.0 through 8.6.1
Applications using DeepDiff's pickle functionality with untrusted input
Systems processing delta objects from external sources

Discovery Timeline

2026-03-20 - CVE CVE-2026-33155 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33155

Vulnerability Analysis

This vulnerability stems from an incomplete security control in DeepDiff's restricted pickle unpickler implementation. The _RestrictedUnpickler class was designed to provide safe deserialization by maintaining an allowlist of classes (SAFE_TO_IMPORT) that can be instantiated during unpickling. However, the security mechanism only validates the class type being instantiated without placing any constraints on the arguments passed to those constructors.

Several built-in Python types included in SAFE_TO_IMPORT—specifically builtins.bytes, builtins.list, and builtins.range—have constructors that allocate memory proportional to their input parameters. An attacker can exploit this by crafting a pickle payload that instructs these constructors to allocate enormous amounts of memory, far exceeding what the system can handle.

Root Cause

The root cause is CWE-400: Uncontrolled Resource Consumption. The _RestrictedUnpickler validates class types but does not implement bounds checking on constructor arguments. This allows attackers to pass arbitrarily large values to memory-allocating constructors, triggering resource exhaustion. The vulnerability affects the pickle_load function and any code path that deserializes delta objects from untrusted sources.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can deliver a malicious pickle payload through any interface where DeepDiff processes untrusted serialized data. The attack is highly efficient—a payload as small as 40 bytes can trigger allocation requests exceeding 10 GB of memory. When the system attempts to fulfill this allocation request, it either crashes the application, triggers out-of-memory conditions, or severely degrades system performance for other processes.

The vulnerability is particularly dangerous in:

Web applications accepting serialized diff objects
API endpoints processing DeepDiff data
Message queue consumers handling pickled payloads
Distributed systems sharing delta computations

Detection Methods for CVE-2026-33155

Indicators of Compromise

Sudden memory spikes in processes using DeepDiff library
Application crashes with out-of-memory errors during pickle operations
Unusual network traffic containing small payloads to endpoints processing serialized data
System logs showing memory allocation failures in Python processes

Detection Strategies

Monitor memory consumption patterns in applications using DeepDiff pickle_load functionality
Implement alerting on processes that exceed baseline memory thresholds during deserialization operations
Deploy application performance monitoring (APM) to detect anomalous resource usage during data processing
Use intrusion detection systems to flag suspicious pickle payloads targeting known vulnerable endpoints

Monitoring Recommendations

Enable detailed logging for all pickle deserialization operations in production environments
Set up resource usage alerts with thresholds appropriate for your application's baseline behavior
Monitor for process terminations due to memory exhaustion, particularly in services handling external input
Track DeepDiff library versions across your software inventory for rapid identification of vulnerable deployments

How to Mitigate CVE-2026-33155

Immediate Actions Required

Upgrade DeepDiff to version 8.6.2 or later immediately
Audit all code paths where pickle_load or delta object deserialization processes untrusted input
Implement input validation and size limits on serialized data before deserialization
Consider containerization with memory limits to prevent system-wide impact from resource exhaustion

Patch Information

The vulnerability has been patched in DeepDiff version 8.6.2. The fix adds constructor argument validation to prevent excessive memory allocation during unpickling operations. The patch is available via the GitHub Commit Update.

For detailed vulnerability information and remediation guidance, refer to the GitHub Security Advisory GHSA-54jj-px8x-5w5q.

Workarounds

Avoid using pickle_load with untrusted data sources until the patch can be applied
Implement memory limits at the process or container level to contain potential exploitation
Use JSON serialization instead of pickle for data exchange where possible
Deploy input sanitization layers that reject oversized or malformed serialized payloads before they reach DeepDiff

bash

# Upgrade DeepDiff to patched version
pip install --upgrade deepdiff>=8.6.2

# Verify installed version
pip show deepdiff | grep Version

# Set container memory limits as a defense-in-depth measure
docker run --memory="512m" --memory-swap="512m" your-application