{"answers":{"affected":"3 open source packages ship an affected version, including ujson. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32875 exists.","fix":"Upgrade ujson to 5.12.0 or later.","what":"CVE-2026-32875 is a high-severity vulnerability in ultrajson, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-32875 and fix it if it is affected.\n\nWhat it is: CVE-2026-32875 is a high-severity vulnerability in ultrajson, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32875 exists.\n\nAffected packages and fixed versions:\n- ujson (PyPI): affected from 5.1.0; fixed in 5.12.0\n- ujson (PyPI): affected from 5.1.0; fixed in 5.12.0\n- ujson (PyPI): affected from 5.1.0; fixed in 5.12.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-32875/ (Markdown: https://insights.sbomify.com/CVE-2026-32875/index.md)","id":"CVE-2026-32875","markdown":"https://insights.sbomify.com/CVE-2026-32875/index.md","name":"CVE-2026-32875","record":{"aliases":["DEBIAN-CVE-2026-32875","ECHO-d87e-e10c-f209","GHSA-c8rr-9gxc-jprv","MINI-8gc5-5xqg-2cg5","PYSEC-2026-2292","ROOT-APP-PYPI-CVE-2026-32875","UBUNTU-CVE-2026-32875"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Python JSON library","requires_auth":"none","summary":"Attacker can cause denial of service via integer overflow in UltraJSON when controlling indent parameters, requiring specific library usage patterns.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"ultrajson","vendor":"ultrajson_project"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-835","name":"Loop with Unreachable Exit Condition"},{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"description":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop","id":"CVE-2026-32875","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":3,"n_references":3,"next":{"headline":"Botan: Heap Buffer Over-read in SM2 Decryption via Undersized C3 Hash Field","id":"CVE-2026-32877"},"packages":[{"ecosystem":"PyPI","fixed":["5.12.0"],"introduced":["5.1.0"],"last_affected":[],"package":"ujson","purl":null,"source":"GHSA-c8rr-9gxc-jprv"},{"ecosystem":"PyPI","fixed":["5.12.0"],"introduced":["5.1.0"],"last_affected":[],"package":"ujson","purl":"pkg:pypi/ujson","source":"GHSA-c8rr-9gxc-jprv"},{"ecosystem":"PyPI","fixed":["5.12.0"],"introduced":["5.1.0"],"last_affected":[],"package":"ujson","purl":"pkg:pypi/ujson","source":"PYSEC-2026-2292"}],"prev":{"headline":"UltraJSON has a Memory Leak parsing large integers allows DoS","id":"CVE-2026-32874"},"products":["ultrajson"],"published":"2026-03-20","related":[{"cvss_score":8.7,"headline":"UltraJSON: Memory Leak in ujson.dump() on Write Failure","id":"CVE-2026-44660","kev_date_added":null,"published":"2026-05-27"},{"cvss_score":7.5,"headline":"UltraJSON has a Memory Leak parsing large integers allows DoS","id":"CVE-2026-32874","kev_date_added":null,"published":"2026-03-20"},{"cvss_score":6.5,"headline":"UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()","id":"CVE-2026-54911","kev_date_added":null,"published":"2026-06-22"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-15","vendors":["ultrajson"]},"summary":"Attacker can cause denial of service via integer overflow in UltraJSON when controlling indent parameters, requiring specific library usage patterns.","url":"https://insights.sbomify.com/CVE-2026-32875/"}