Memory Leak in UltraJSON JSON Encoder and Decoder Affecting Multiple Versions

CVE-2026-32874

What is CVE-2026-32874?

UltraJSON, a fast JSON encoder and decoder, is prone to a memory leak when processing large integers beyond the specified range. This vulnerability manifests across versions 5.4.0 to 5.11.0 and involves leaking memory that represents the string form of the integer, along with an additional NULL byte. Since the leak can occur regardless of whether the integer processes successfully or is deemed invalid, any service reliant on ujson.load(), ujson.loads(), or ujson.decode() with untrusted JSON input is at risk. This exploitation can lead to denial of service attacks through the consumption of server resources, making it crucial to upgrade to version 5.12.0, where the issue is resolved.

References