Executive brief
UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.
Affected products
- PyPI ujson
Junglewise Threat Intelligence
CVE-2021-45958: PYSEC-2022-25 - UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can
CVE-2021-45958 · Severity: low · CVSS 3.1 · Published 2022-01-01
Technologies: ujson (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1057 - Incorrect handling of invalid surrogate pair characters
- PYSEC-2026-1056 - Potential double free of buffer during string decoding
- UltraJSON improper input validation in ujson.dumps UTF-8 handling
- UltraJSON memory leak in ujson.dump on write failure
- UltraJSON integer overflow in indent handling