CVE-2026-32875: ujson Integer Overflow Leading to Denial of Service

Background

UltraJSON, commonly known as ujson, is a high-performance JSON encoder and decoder for Python. It is designed to provide faster serialization and deserialization of JSON data compared to the standard library's json module. However, due to its handling of the 'indent' parameter, ujson is susceptible to an integer overflow vulnerability that can lead to severe issues, including crashes and infinite loops.

Vulnerability Detail

The vulnerability arises when the 'indent' parameter in ujson's dumps function is manipulated. If the product of the 'indent' value and the nested depth of the input exceeds INT32_MAX, it can cause the Python interpreter to crash due to a segmentation fault. Additionally, if a large negative number is provided as the indent, it can lead to an infinite loop. This vulnerability can be exploited to achieve denial of service, making it critical for services that rely on ujson to handle untrusted input.

pip install --upgrade "ujson==6.0.0"

pip install --upgrade "ujson==5.12.0"

Workaround

If upgrading is not feasible, consider using a fixed indentation value, avoiding negative indents, or ensuring that the indent is non-negative and below 2**31. Here is an example code snippet to demonstrate safe usage:

import ujson

def safe_example(depth, indent):
    if indent < 0 or indent > 1000:
        raise ValueError('Indent must be non-negative and not exceed 1000.')
    a = [0]
    for i in range(depth):
        a = [a]
    return ujson.dumps(a, indent=indent)

# Usage
safe_example(1000, 2)  # Safe usage

Conclusion

The integer overflow vulnerability in ujson can lead to significant issues, including application crashes and denial of service. It is crucial to update to the patched version or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.

See every vulnerability recorded for ujson →

FAQ