TI-2026-32560 CVE-2026-44660 · GHSA-c38f-wx89-p2xg
UltraJSON: Memory Leak in ujson.dump() on Write Failure
Priority HIGH 77
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+.
ultrajson
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
ultrajson records in CISA KEVNo ultrajson vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2026-25335 CVE-2026-32875 · GHSA-c8rr-9gxc-jprv
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
Priority HIGH 72
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+.
TI-2022-13160 CVE-2022-31116 · GHSA-wpqr-jcpx-745r
Incorrect handling of invalid surrogate pair characters in ujson
Priority HIGH 72
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+.
TI-2026-25334 CVE-2026-32874 · GHSA-wgvc-ghv9-3pmm
UltraJSON has a Memory Leak parsing large integers allows DoS
Priority LOW 39
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+.
TI-2026-39683 CVE-2026-54911 · GHSA-3j69-69wj-xqx2
UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
Priority LOW 35
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+.
TI-2022-13161 CVE-2022-31117 · GHSA-fm67-cv37-96ff
Double free of buffer during string decoding in ujson
Priority LOW 30
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+.
TI-2021-20961 CVE-2021-45958 · GHSA-fh56-85cw-5pq6
UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in…
Priority LOW 28
UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode).