Stack-buffer-overflow in Buffer_AppendIndentUnchecked in ujson
Summary
OSV-2021-955: Stack-buffer-overflow in Buffer_AppendIndentUnchecked. Affects ujson across 2 version ranges.
>= 0c52200eb4e2d97e548a765d5f089858c41967b0, < f6860f1f3d8d4e92b9be0e5815355a8976c6e75b
< 5525f8c9ef8bb879dadd0eb942d524827d1b0362
Fixed in f6860f1f3d8d4e92b9be0e5815355a8976c6e75b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ujson is a Python package available on PyPI that provides ultra-fast JSON encoding and decoding. It is widely used for efficient JSON processing in Python applications. However, a vulnerability has been discovered in the package that can lead to a stack-buffer-overflow.
Vulnerability Detail
The vulnerability in ujson arises from a stack-buffer-overflow in the function Buffer_AppendIndentUnchecked. This can be triggered when encoding certain JSON data. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The issue was reported through the OSS-Fuzz project and has been assigned a high severity level.
How To Fix
Latest published version: 6.0.0 as of 23 Oct 2026
pip install --upgrade "ujson==6.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
f6860f1f3d8d4e92b9be0e5815355a8976c6e75b
This is the first release that contains the fix.
pip install --upgrade "ujson==f6860f1f3d8d4e92b9be0e5815355a8976c6e75b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating ujson is not immediately feasible, a possible workaround is to switch to an alternative JSON processing library that is not affected by this vulnerability. One such option is the built-in json module in Python's standard library.
Conclusion
In conclusion, the ujson package is vulnerable to a stack-buffer-overflow issue that can have serious security implications. It is crucial to update the package to a fixed version or consider using an alternative JSON processing library. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ujson →
FAQ
ujson is a Python package that provides ultra-fast JSON encoding and decoding. It is commonly used for efficient JSON processing in Python applications.
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition in applications that use ujson for JSON processing.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software to uncover potential security issues.
This vulnerability has been assigned a high severity level due to its potential for arbitrary code execution and the impact it can have on affected applications.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is important to promptly apply the recommended fixes to mitigate any potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for ujson.
