CVE-2026-32875
published 2026-03-20CVE-2026-32875: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.47%
38.2th percentile
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ujson | — | — |
| ubuntu | ujson | — | — |
| ultrajson | ultrajson | — | — |
| ultrajson_project | ultrajson | >= 5.1.0 < 5.12.0 | 5.12.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
UltraJSON vulnerabilities
vendor_ubuntu·2026-04-28·CVSS 7.5
CVE-2026-32875 [HIGH] UltraJSON vulnerabilities
Title: UltraJSON vulnerabilities
Summary: Several security issues were fixed in UltraJSON.
Cameron Criswell discovered that UltraJSON contained a memory leak
that would occur when parsing large integers. An attacker could
possibly use this issue to cause UltraJSON to crash, resulting in a
denial of service. This issue only affected Ubuntu 24.04 LTS,
Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32874)
It was discovered that UltraJSON contained integer overflow/underflow
issues when calculating how much memory to reserve for indentation in
certain instances. An attacker could possibly use this issue to cause
UltraJSON to crash, resulting in a denial of service. (CVE-2026-32875)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
ultrajson: UltraJSON: Denial of Service via large indent parameter in JSON serialization
vendor_redhat·2026-03-20·CVSS 7.5
CVE-2026-32875 [HIGH] CWE-190 ultrajson: UltraJSON: Denial of Service via large indent parameter in JSON serialization
ultrajson: UltraJSON: Denial of Service via large indent parameter in JSON serialization
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untr
Debian
CVE-2026-32875: ujson - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for...
vendor_debian·2026·CVSS 7.5
CVE-2026-32875 [HIGH] CVE-2026-32875: ujson - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for...
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasona
OSV
CVE-2026-32875: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3
osv·2026-03-20·CVSS 7.5
CVE-2026-32875 [HIGH] CVE-2026-32875: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasona
OSV
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
osv·2026-03-18
CVE-2026-32875 [HIGH] UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
### Summary
`ujson.dumps()` crashes the Python interpreter (segmentation fault) when the product of the `indent` parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the `indent` is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service.
(Note: A negative indent to `ujson` means add spaces after colons but do not add line breaks or indentation. It is unclear to the current maintainers whether this was ever even an intended feature or just a byproduct of the way it was written.)
### Exploitability
To be vu
GHSA
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
ghsa·2026-03-18
CVE-2026-32875 [HIGH] CWE-190 UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
### Summary
`ujson.dumps()` crashes the Python interpreter (segmentation fault) when the product of the `indent` parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the `indent` is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service.
(Note: A negative indent to `ujson` means add spaces after colons but do not add line breaks or indentation. It is unclear to the current maintainers whether this was ever even an intended feature or just a byproduct of the way it was written.)
### Exploitability
To be vu
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-32875 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-32875 [HIGH] CVE-2026-32875 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-32875 :
Python vulnerability analysis and mitigation
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control ove
Bugzilla
CVE-2026-32875 ultrajson: UltraJSON: Denial of Service via large indent parameter in JSON serialization
bugzilla·2026-03-20·CVSS 7.5
CVE-2026-32875 [HIGH] CVE-2026-32875 ultrajson: UltraJSON: Denial of Service via large indent parameter in JSON serialization
CVE-2026-32875 ultrajson: UltraJSON: Denial of Service via large indent parameter in JSON serialization
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whi
https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37eahttps://github.com/ultrajson/ultrajson/issues/700https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c8rr-9gxc-jprvhttps://access.redhat.com/security/cve/CVE-2026-32875https://bugzilla.redhat.com/show_bug.cgi?id=2449400https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32875.json
2026-03-20
Published