Buffer Overflow and Infinite Loop in UltraJSON by May Lead to Denial of Service

CVE-2026-32875

What is CVE-2026-32875?

The UltraJSON library, a JSON encoder and decoder for Python, exhibits a serious vulnerability in versions 5.10 to 5.11.0, stemming from improper handling of the indent parameter. When input data generates an indent value multiplied by a nested depth exceeding INT32_MAX, it leads to a buffer overflow that results in a segmentation fault, crashing the Python interpreter. Additionally, if a large negative number is used as the indent value, it can cause the system to enter an infinite loop. Services using ujson.dump(), ujson.dumps(), or ujson.encode() with untrusted user input for indentation are particularly at risk. The design flaw can be mitigated by upgrading to version 5.12.0, which resolves these vulnerabilities.

References