UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-190 and the CVSS impact.
Summary
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ultrajson | ultrajson | 5.1.0 to before 5.12.0 | 5.12.0 | Patch available | CNA |
| — | ujson (PyPI) | 5.1.0 to before 5.12.0 | 5.12.0 | Patch available | GHSA-c8rr-9gxc-jprv |
- ultrajson Vendorultrajson Affected 5.1.0 to before 5.12.0 Fixed in 5.12.0 Patch available CNA
- ujson (PyPI) Vendor— Affected 5.1.0 to before 5.12.0 Fixed in 5.12.0 Patch available GHSA-c8rr-9gxc-jprv
Remediation
- Fix · CNA ultrajson (ultrajson) Fixed in 5.12.0
- Fix · GHSA-c8rr-9gxc-jprv ujson (PyPI) Fixed in 5.12.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-32875
- 2026-10-03 Alias added: GHSA-c8rr-9gxc-jprv
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More Ultrajson vulnerabilities
- TI-2026-32560 UltraJSON: Memory Leak in ujson.dump() on Write Failure CVSS 4.0HIGH 8.7
- TI-2022-13160 Incorrect handling of invalid surrogate pair characters in ujson CVSS 3.1HIGH 7.5
- TI-2026-25334 UltraJSON has a Memory Leak parsing large integers allows DoS CVSS 3.1HIGH 7.5
- TI-2026-39683 UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps() CVSS 3.1MEDIUM 6.5
- TI-2022-13161 Double free of buffer during string decoding in ujson CVSS 3.1MEDIUM 5.9
- TI-2021-20961 UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-32875 · CVE Program
- CVE-2026-32875 · NVD
- FIRST EPSS
- GHSA-c8rr-9gxc-jprv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-32875 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences