{"id":"CVE-2026-32875","aliases":["ALPINE-CVE-2026-32875","DEBIAN-CVE-2026-32875","EUVD-2026-13444","GHSA-c8rr-9gxc-jprv","MGASA-2026-0073","OESA-2026-3607","OESA-2026-3608","OESA-2026-3720","PYSEC-2026-2292","ROOT-APP-PYPI-CVE-2026-32875","UBUNTU-CVE-2026-32875"],"status":"published","title":"UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop","description":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00488,"percentile":0.42323,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-787","CWE-835"],"published":"2026-03-18T13:01:24Z","modified":"2026-11-03T06:33:02Z","fixes":[{"ecosystem":"PyPI","package":"ujson","fixed_in":["5.12.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-ujson","fixed_in":["5.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-ujson","fixed_in":["5.12.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ujson","fixed_in":["5.13.0-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"ujson","fixed_in":["5.10.0+aikido.5","5.8.0+aikido.4","5.10.0+aikido.6","5.8.0+aikido.5","5.8.0+aikido.6","5.10.0+aikido.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ujson","fixed_in":["5.1.0-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ujson","fixed_in":["5.9.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"ujson","fixed_in":["5.10.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"ujson","fixed_in":["5.11.0-3ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"last_affected":"5.11.0"},{"fixed":"5.12.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1","5.11.0-1","5.11.0-2","5.11.0-3","5.13.0-1","5.7.0-1","5.8.0-1","5.9.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1","5.11.0-1","5.11.0-2","5.11.0-3","5.13.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.0-1"}]}],"versions":["5.10.0-1","5.11.0-1","5.11.0-2","5.11.0-3"]},{"source":"osv","ecosystem":"PyPI","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.12.0"}]}],"versions":["5.1.0","5.10.0","5.11.0","5.2.0","5.3.0","5.4.0","5.5.0","5.6.0","5.7.0","5.8.0","5.9.0"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.0-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-6.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-7.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-6.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.12.0"}]}],"versions":["5.1.0","5.10.0","5.11.0","5.2.0","5.3.0","5.4.0","5.5.0","5.6.0","5.7.0","5.8.0","5.9.0"]},{"source":"osv","ecosystem":"Root:PyPI","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0+aikido.5"},{"fixed":"5.8.0+aikido.4"},{"fixed":"5.10.0+aikido.6"},{"fixed":"5.8.0+aikido.5"},{"fixed":"5.8.0+aikido.6"},{"fixed":"5.10.0+aikido.7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.1~esm2"}]}],"versions":["4.0.2-1","4.0.2-1build1","4.2.0-1","5.1.0-1","5.1.0-1build1","5.1.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.0-1ubuntu0.1~esm1"}]}],"versions":["5.8.0-1","5.8.0-1build1","5.9.0-1","5.9.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-1ubuntu0.1"}]}],"versions":["5.10.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-3build1","5.13.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ujson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.0-3ubuntu0.1"}]}],"versions":["5.10.0-1build2","5.10.0-1build3","5.11.0-3","5.11.0-3build1"]}],"products":[{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.1"},{"vendor":"red hat","product":"red hat openstack platform 18.0"},{"vendor":"ultrajson","product":"ultrajson"},{"vendor":"ultrajson_project","product":"ultrajson"}],"references":[{"url":"https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c8rr-9gxc-jprv","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","evidence","report"]},{"url":"https://github.com/ultrajson/ultrajson/issues/700","tags":["x_refsource_MISC","Issue Tracking","report","web"]},{"url":"https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32875","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449400","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32875.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32875","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c8rr-9gxc-jprv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-32875","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32875.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-32875","tags":["advisory"]},{"url":"https://github.com/ultrajson/ultrajson","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0073.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35258","tags":["report"]},{"url":"https://github.com/ultrajson/ultrajson/security/advisories/GHSA-wgvc-ghv9-3pmm","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3FAXR2DP4Q5GMDURV7CAFQ5YGYAOMVNL/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3607","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45958","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44660","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54911","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3608","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3720","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-32875","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32875","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8219-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-32875","title":"UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop","description":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.","status":"published","published":"2026-03-20T01:35:23.362Z","modified":"2026-07-15T01:07:31.359Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-190","CWE-787","CWE-835","CWE-190"],"updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-13444","description":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.","status":"published","published":"2026-03-20T01:35:23Z","modified":"2026-07-15T01:07:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:56.47701Z"}],"ghsa":[{"id":"GHSA-c8rr-9gxc-jprv","title":"UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop","description":"### Summary\n\n`ujson.dumps()` crashes the Python interpreter (segmentation fault) when the product of the `indent` parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the `indent` is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service.\n\n(Note: A negative indent to `ujson` means add spaces after colons but do not add line breaks or indentation. It is unclear to the current maintainers whether this was ever even an intended feature or just a byproduct of the way it was written.)\n\n### Exploitability\n\nTo be vulnerable, a service must call `ujson.dump()`/`ujson.dumps()`/`ujson.encode()` whilst giving untrusted users control over the `indent` parameter and not restrict that indentation to reasonably small non-negative values. (Even with the fix for this vulnerability, such usage is strongly advised against since even a bug-free JSON serialiser would be vulnerable to denial of service simply by the attacker requesting indents that have the server needlessly filling out gigabytes of whitespace.)\n\nA service may also be vulnerable to the infinite loop if it uses a fixed _negative_ `indent`. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. As far as the maintainers are aware, the infinite loop can not be reached for indentations from -1 to -65536 / max_recursion_depth_as_limited_by_stack_size but users of negative indents are encouraged to consider their service affected even if the infinite loop seems unreachable.\n\n### Example\n\n```python\nimport ujson\n\ndef example(depth, indent):\n    a = [0]\n    for i in range(1000):\n        a = [a]\n    ujson.dumps(a, indent=indent)\n\nexample(1, 2**30)  # segfault\nexample(1000, -200)  # infinite loop\n```\n\n### Patches\n\nujson 5.12.0, containing 486bd4553dc471a1de11613bc7347a6b318e37ea, promotes the integer types where the overflow occurred, skips the indentation code path for negative indent (which was supposed to be a no-op) and places an artificial cap of 1000 on the `indent` parameter.\n\n### Workarounds\n\nUsers who don't wish to upgrade can either use a fixed indentation, no indentation or ensure indentation is non-negative and not enormous (below `2**31 / max_recursion_depth_as_limited_by_stack_size`).\n\n### References\n\nThe original bug report can be found at https://github.com/ultrajson/ultrajson/issues/700\n\nThis issue was independently discovered by @coco1629, @EthanKim88 and @vmfunc.","status":"published","published":"2026-03-18T13:01:24Z","modified":"2026-03-20T21:19:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190","CWE-787","CWE-835"],"updated_at":"2026-11-02T14:39:39.567266Z"}],"nvd":[{"id":"CVE-2026-32875","description":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.","status":"published","published":"2026-03-20T02:16:35.887Z","modified":"2026-07-15T02:20:01.993Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190","CWE-787","CWE-835"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"ALPINE-CVE-2026-32875","description":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.","status":"published","published":"2026-03-20T02:16:35.887Z","modified":"2026-11-03T06:33:02.354298697Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-32875","title":"UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop","description":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.","status":"published","published":"2026-03-20T01:35:23.362Z","modified":"2026-10-28T11:11:44.683449776Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190","CWE-787","CWE-835"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-32875","description":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.","status":"published","published":"2026-03-20T02:16:35.887Z","modified":"2026-10-01T03:03:21.995693972Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-c8rr-9gxc-jprv","title":"UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop","description":"### Summary\n\n`ujson.dumps()` crashes the Python interpreter (segmentation fault) when the product of the `indent` parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the `indent` is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service.\n\n(Note: A negative indent to `ujson` means add spaces after colons but do not add line breaks or indentation. It is unclear to the current maintainers whether this was ever even an intended feature or just a byproduct of the way it was written.)\n\n### Exploitability\n\nTo be vulnerable, a service must call `ujson.dump()`/`ujson.dumps()`/`ujson.encode()` whilst giving untrusted users control over the `indent` parameter and not restrict that indentation to reasonably small non-negative values. (Even with the fix for this vulnerability, such usage is strongly advised against since even a bug-free JSON serialiser would be vulnerable to denial of service simply by the attacker requesting indents that have the server needlessly filling out gigabytes of whitespace.)\n\nA service may also be vulnerable to the infinite loop if it uses a fixed _negative_ `indent`. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. As far as the maintainers are aware, the infinite loop can not be reached for indentations from -1 to -65536 / max_recursion_depth_as_limited_by_stack_size but users of negative indents are encouraged to consider their service affected even if the infinite loop seems unreachable.\n\n### Example\n\n```python\nimport ujson\n\ndef example(depth, indent):\n    a = [0]\n    for i in range(1000):\n        a = [a]\n    ujson.dumps(a, indent=indent)\n\nexample(1, 2**30)  # segfault\nexample(1000, -200)  # infinite loop\n```\n\n### Patches\n\nujson 5.12.0, containing 486bd4553dc471a1de11613bc7347a6b318e37ea, promotes the integer types where the overflow occurred, skips the indentation code path for negative indent (which was supposed to be a no-op) and places an artificial cap of 1000 on the `indent` parameter.\n\n### Workarounds\n\nUsers who don't wish to upgrade can either use a fixed indentation, no indentation or ensure indentation is non-negative and not enormous (below `2**31 / max_recursion_depth_as_limited_by_stack_size`).\n\n### References\n\nThe original bug report can be found at https://github.com/ultrajson/ultrajson/issues/700\n\nThis issue was independently discovered by @coco1629, @EthanKim88 and @vmfunc.","status":"published","published":"2026-03-18T13:01:24Z","modified":"2026-09-10T03:50:38.822207675Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190","CWE-787","CWE-835"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"OESA-2026-3607","title":"python-ujson security update","description":"UltraJSON\r\n\r\nSecurity Fix(es):\n\nUltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.(CVE-2021-45958)\n\nUltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.(CVE-2026-32875)\n\nUltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.(CVE-2026-44660)\n\nUltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.(CVE-2026-54911)","status":"published","published":"2026-09-05T15:03:06Z","modified":"2026-09-05T15:16:25.284263547Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3608","title":"python-ujson security update","description":"UltraJSON\r\n\r\nSecurity Fix(es):\n\nUltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.(CVE-2021-45958)\n\nUltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.(CVE-2026-32875)\n\nUltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.(CVE-2026-44660)\n\nUltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.(CVE-2026-54911)","status":"published","published":"2026-09-05T15:03:07Z","modified":"2026-09-05T15:16:22.436261367Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3720","title":"python-ujson security update","description":"UltraJSON\r\n\r\nSecurity Fix(es):\n\nUltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.(CVE-2021-45958)\n\nUltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.(CVE-2026-32875)\n\nUltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.(CVE-2026-44660)\n\nUltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.(CVE-2026-54911)","status":"published","published":"2026-09-14T16:33:43Z","modified":"2026-09-13T16:45:31.33071619Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"PYSEC-2026-2292","description":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.","status":"published","published":"2026-03-20T02:16:35.887Z","modified":"2026-07-13T07:15:42.50688146Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"ROOT-APP-PYPI-CVE-2026-32875","title":"CVE-2026-32875 in ujson - Patched by Root","description":"Root has patched CVE-2026-32875 in the ujson package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-07T06:40:22Z","modified":"2026-10-07T07:15:05.483725324Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"UBUNTU-CVE-2026-32875","description":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.","status":"published","published":"2026-03-20T02:16:00Z","modified":"2026-10-17T12:59:59.179109925Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"MGASA-2026-0073","title":"Updated python-ujson packages fix security vulnerabilities","description":"CVE-2026-32874 ujson 5.4.0 to 5.11.0 inclusive contains an accumulating\nmemory leak in JSON parsing large (outside of the range [-2^63, 2^64 - 1])\nintegers.\nujson 5.4.0 to 5.11.0 has an integer overflow while handling a large indent\nwhich leads to a buffer overflow or infinite loop.\n","status":"published","published":"2026-03-29T00:55:09Z","modified":"2026-04-16T04:42:16.221669775Z","updated_at":"2026-11-02T15:49:43.178336Z"}]}}