Junglewise Threat Intelligence

CVE-2026-32875: UltraJSON integer overflow in indent handling

CVE-2026-32875 · Severity: high · CVSS 7.5 · Published 2026-03-20

Technologies: UltraJSON. Vendors: UltraJSON, PyPI.

Executive brief

UltraJSON is a high-speed library used by Python developers to convert data into JSON format. A flaw in how it handles indentation settings allows an attacker to crash the application or force it into an infinite loop by providing specially crafted input. This can lead to a total service outage (Denial of Service), preventing legitimate users from accessing the application.

Technical details

UltraJSON (ujson) versions 5.1.0 through 5.11.0 contain an integer overflow/underflow vulnerability in the C-based JSON encoder. When calling ujson.dumps(), ujson.dump(), or ujson.encode(), if the product of the 'indent' parameter and the nesting depth of the input object exceeds INT32_MAX, an integer overflow leads to an undersized buffer allocation and a subsequent heap buffer overflow (segmentation fault). Additionally, large negative indentation values can trigger an integer underflow, causing the buffer resizing logic to enter an infinite loop. An attacker can exploit this by controlling the 'indent' parameter or providing deeply nested objects to a service that uses untrusted indentation values. The issue is fixed in version 5.12.0 by promoting integer types, capping the indent parameter at 1000, and skipping indentation logic for negative values.

Affected products

  • ultrajson UltraJSON (ujson) >= 5.1.0, < 5.12.0

Timeline

  • 2026-02-06: disclosed: Initial bug report on GitHub issue #700
  • 2026-03-17: advisory: GitHub Security Advisory published
  • 2026-03-20: patched: Version 5.12.0 released with fix

References

Related threats