CVE-2026-32875 UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
Attacker can cause denial of service via integer overflow in UltraJSON when controlling indent parameters, requiring specific library usage patterns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32875?
CVE-2026-32875 is a high-severity vulnerability in ultrajson, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.
Which versions are affected by CVE-2026-32875?
3 open source packages ship an affected version, including ujson. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ujson PyPI | From 5.1.0 | 5.12.0 |
ujson PyPI | From 5.1.0 | 5.12.0 |
ujson PyPI | From 5.1.0 | 5.12.0 |
Products include Ultrajson Project Ultrajson.
How do I fix CVE-2026-32875?
Upgrade ujson to 5.12.0 or later.
Is CVE-2026-32875 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32875 exists.
Other vulnerabilities in ultrajson
Sources
Also known as DEBIAN-CVE-2026-32875, ECHO-d87e-e10c-f209, GHSA-c8rr-9gxc-jprv, MINI-8gc5-5xqg-2cg5, PYSEC-2026-2292, ROOT-APP-PYPI-CVE-2026-32875 and 1 more.