Skip to content
Fencer Vulns
high 7.5

CVE-2026-32875 json

UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

published 2026-03-18 7 mo ago modified 2026-09-10 1 mo ago also GHSA-c8rr-9gxc-jprv , PYSEC-2026-2292 , EUVD-2026-13444

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.

Patch / fix

  • pypi ujson 5.12.0
  • ultrajson_project ultrajson 5.12.0
  • ujson Debian 14 5.13.0-1

debian advisories DEBIAN-CVE-2026-32875

  • ujson Ubuntu 25.10 5.10.0-1ubuntu0.1
  • ujson Ubuntu 26.04 LTS 5.11.0-3ubuntu0.1
  • ujson Ubuntu Pro 22.04 LTS 5.1.0-1ubuntu0.1~esm2
  • ujson Ubuntu Pro 24.04 LTS 5.9.0-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-32875

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • py3-ujson Alpine 3.24, Alpine 3.23 5.12.0-r0

alpine advisories ALPINE-CVE-2026-32875

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-32875 updated cvss 7.5

ultrajson: UltraJSON: Denial of Service via large indent parameter in JSON serialization

  • Red Hat OpenStack Platform 16.2 python-ujson, python3-ujson Red Hat OpenStack Platform 17.1 python3-ujson Red Hat OpenStack Platform 18.0 python-ujson
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c8rr-9gxc-jprv referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi ujson
>=5.1.0, <5.12.0
5.12.0

Affected products

  • ultrajson ultrajson
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound
  • CWE-787 Out-of-bounds Write
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.