CVE-2026-32875: UltraJSON integer overflow in indent handling

CVE-2026-32875 · Severity: high · CVSS 7.5 · Published 2026-03-20

UltraJSON is a high-speed library used by Python developers to convert data into JSON format. A flaw in how it handles indentation settings allows an attacker to crash the application or force it into an infinite loop by providing specially crafted input. This can lead to a total service outage (Denial of Service), preventing legitimate users from accessing the application.

Technologies: ujson (PyPI), UltraJSON. Vendors: PyPI, UltraJSON.

Quick answers

Is CVE-2026-32875 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32875 being exploited in the wild.
How severe is CVE-2026-32875?
High severity, with a CVSS score of 7.5, published 20 March 2026.
Which products and versions are affected?
ujson (PyPI) ECOSYSTEM:introduced=5.1.0,fixed=5.12.0; UltraJSON >= 5.1.0, < 5.12.0.
Is there a fix for CVE-2026-32875?
Yes. ujson (PyPI): upgrade to 5.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32875 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-32875?
Check whether you run ujson (PyPI) or UltraJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ujson (PyPI): upgrade to 5.12.0 or later
    pip install "ujson>=5.12.0"

Technical details

UltraJSON (ujson) versions 5.1.0 through 5.11.0 contain an integer overflow/underflow vulnerability in the C-based JSON encoder. When calling ujson.dumps(), ujson.dump(), or ujson.encode(), if the product of the 'indent' parameter and the nesting depth of the input object exceeds INT32_MAX, an integer overflow leads to an undersized buffer allocation and a subsequent heap buffer overflow (segmentation fault). Additionally, large negative indentation values can trigger an integer underflow, causing the buffer resizing logic to enter an infinite loop. An attacker can exploit this by controlling the 'indent' parameter or providing deeply nested objects to a service that uses untrusted indentation values. The issue is fixed in version 5.12.0 by promoting integer types, capping the indent parameter at 1000, and skipping indentation logic for negative values.

Affected products

  • ultrajson UltraJSON (ujson) >= 5.1.0, < 5.12.0

Identifiers

  • CVE-2026-32875
  • GHSA-c8rr-9gxc-jprv
  • PYSEC-2026-2292

Timeline

  • 2026-02-06: disclosed: Initial bug report on GitHub issue #700
  • 2026-03-17: advisory: GitHub Security Advisory published
  • 2026-03-20: patched: Version 5.12.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.