Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

UltraJSON can crash or hang on large indent values

CVE-2026-32875 · published 7 months ago
Summary

Versions 5.10 to 5.11.0 of UltraJSON may stop working or freeze when a program asks it to format JSON with an excessively large or negative indent setting. This can cause the Python application to crash or become unresponsive, leading to a denial‑of‑service situation. Update to UltraJSON 5.12.0 or later and ensure any indent values provided by users are limited to small, non‑negative numbers.

What to do
  • Update jonas tarnstrom ujson to version 5.12.0.
  • Update rootio-ujson to version 5.10.0+root.io.2.
  • Update rootio-ujson to version 5.10.0+root.io.4.
  • Update jonas tarnstrom ujson to version 5.8.0+aikido.5.
  • Update rootio-ujson to version 5.8.0+root.io.4.
  • Update ujson to version 5.10.0+aikido.7.
  • Update canonical ujson to version 5.1.0-1ubuntu0.1~esm2.
  • Update canonical ujson to version 5.9.0-1ubuntu0.1~esm1.
  • Update canonical ujson to version 5.10.0-1ubuntu0.1.
  • Update canonical ujson to version 5.11.0-3ubuntu0.1.
  • Update ultrajson_project ultrajson to version 5.12.0 or later.
Affected software
Ecosystem VendorProductAffected versions
pip jonas tarnstrom ujson >= 5.1.0, <= 5.11.0
Fix: upgrade to 5.12.0
Debian:11 debian ujson All versions
– ultrajson_project ultrajson >= 5.1.0, < 5.12.0
cpe:2.3:a:ultrajson_project:ultrajson:*:*:*:*:*:python:*:*
Root:PyPI – rootio-ujson < 5.10.0+root.io.2
< 5.10.0+root.io.4
< 5.8.0+root.io.4
Fix: upgrade to 5.10.0+root.io.2
Debian:12 debian ujson All versions
Debian:13 debian ujson All versions
Debian:14 debian ujson All versions
Root:PyPI jonas tarnstrom ujson < 5.8.0+aikido.5
Fix: upgrade to 5.8.0+aikido.5
Root:PyPI – ujson < 5.10.0+aikido.7
Fix: upgrade to 5.10.0+aikido.7
Ubuntu:Pro:22.04:LTS canonical ujson < 5.1.0-1ubuntu0.1~esm2
Fix: upgrade to 5.1.0-1ubuntu0.1~esm2
Ubuntu:Pro:24.04:LTS canonical ujson < 5.9.0-1ubuntu0.1~esm1
Fix: upgrade to 5.9.0-1ubuntu0.1~esm1
Ubuntu:25.10 canonical ujson < 5.10.0-1ubuntu0.1
Fix: upgrade to 5.10.0-1ubuntu0.1
Ubuntu:26.10 canonical ujson All versions
Ubuntu:26.04:LTS canonical ujson < 5.11.0-3ubuntu0.1
Fix: upgrade to 5.11.0-3ubuntu0.1
Original advisory text
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-190Integer Overflow
CWE-787Out-of-bounds Write
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published20 Mar 2026
Updated4 Nov 2026
First seen18 Mar 2026
Sources
GHSA-c8rr-9gxc-jprv · GHSA
CVE-2026-32875 · NVD
CVE-2026-32875 · OSV
ROOT-APP-PYPI-CVE-2026-32875 · OSV
DEBIAN-CVE-2026-32875 · OSV
UBUNTU-CVE-2026-32875 · OSV
Track software like this
Free during beta