CVE-2026-32875 in UltraJSON
Summary
by MITRE • 03/20/2026
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/25/2026
The vulnerability described in CVE-2026-32875 affects UltraJSON, a high-performance JSON encoder and decoder implemented in C with Python bindings. This library is widely used in applications requiring fast JSON processing, making the vulnerability particularly concerning for systems that process untrusted JSON data. The flaw manifests specifically in versions 5.10 through 5.11.0 where improper handling of the indent parameter creates exploitable conditions that can lead to system instability and denial of service. The vulnerability stems from inadequate bounds checking during memory allocation calculations when processing JSON data with specific indentation parameters.
The technical root cause involves integer overflow and underflow conditions that occur during the calculation of memory requirements for indentation purposes. When the product of the indent parameter and nested depth exceeds INT32_MAX, the system experiences a buffer overflow that results in segmentation faults and interpreter crashes. Additionally, when negative indent values are used, particularly large negative numbers, the calculation produces underflow conditions that can cause infinite loops. This occurs because the memory reservation calculation fails to properly validate input parameters, leading to mathematical overflow/underflow scenarios that are not properly handled by the underlying C code. The vulnerability is classified under CWE-190 as an integer overflow/underflow condition, which represents a fundamental flaw in arithmetic operations that can lead to memory corruption or denial of service.
The operational impact of this vulnerability is significant for any service that accepts untrusted input and allows users to control the indent parameter during JSON serialization operations. Attackers can exploit this by crafting malicious JSON data with carefully calculated indentation parameters that trigger either segmentation faults or infinite loops, effectively causing denial of service attacks against applications using vulnerable versions of UltraJSON. The vulnerability is particularly dangerous because it can be triggered through normal JSON processing operations without requiring special privileges or complex attack vectors. Services that process user-provided JSON data, including web applications, APIs, and data processing pipelines, are at risk if they do not properly validate or constrain the indent parameter values. The issue affects both ujson.dumps() and ujson.encode() functions, making it applicable to a broad range of use cases where JSON serialization occurs.
Mitigation strategies should focus on immediate remediation through version upgrade to 5.12.0 or later, which contains the necessary patches to address the integer overflow and underflow conditions. Organizations should also implement input validation measures that restrict indent parameter values to reasonable ranges, typically non-negative values below a safe threshold. The fix implemented in version 5.12.0 involves proper bounds checking and overflow detection during memory allocation calculations, preventing the mathematical conditions that previously led to crashes or infinite loops. Additionally, security monitoring should be enhanced to detect unusual patterns in JSON processing that might indicate exploitation attempts, particularly around memory allocation spikes or processing timeouts. This vulnerability aligns with ATT&CK technique T1499.004 for network denial of service and demonstrates the importance of proper input validation in preventing memory corruption vulnerabilities in high-performance libraries. Organizations should also consider implementing sandboxing or resource limiting for JSON processing operations to further reduce the impact of potential exploitation attempts.