7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32874

CVE-2026-32874: UltraJSON has a Memory Leak parsing large integers allows DoS

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large (outside of the range [-2^63, 2^64 - 1]) integers. The leaked memory is a copy of the string form of the integer plus an additional NULL byte. The leak occurs irrespective of whether the integer parses successfully or is rejected due to having more than sys.get_int_max_str_digits() digits, meaning that any sized leak per malicious JSON can be achieved provided that there is no limit on the overall size of the payload. Any service that calls ujson.load()/ujson.loads()/ujson.decode() on untrusted inputs is affected and vulnerable to denial of service attacks. This issue has been fixed in version 5.12.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32874

CVE-2026-32874:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ujson	pip	>= 5.4.0, <= 5.11.0	5.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a memory leak within the C implementation of the ultrajson library, which can be triggered to cause a denial of service. The analysis of the fixing commit 4baeb950df780092bd3c89fc702a868e99a3a1d2 points to a specific function in the C source code. The file src/ujson/python/JSONtoObj.c was modified to fix the leak. The function Object_newIntegerFromString allocates a memory buffer to process large integers from a JSON string. The patch introduces a call to PyObject_Free() to release this buffer, which was previously not being done, causing memory to be leaked on each call with a large integer. The public Python APIs such as ujson.load(), ujson.loads(), and ujson.decode() are the entry points that use this vulnerable C function. Therefore, any service using these functions to parse untrusted JSON is susceptible to a denial-of-service attack by sending JSON payloads with large integer values.

Vulnerable functions

Object_newIntegerFromString

src/ujson/python/JSONtoObj.c

This function is responsible for converting a string representation of an integer from the JSON input into a Python integer object. It allocates a buffer `buf` to hold the string. The patch adds `PyObject_Free(buf)` to release this buffer. Before the fix, this buffer was not freed, leading to a memory leak every time a large integer was parsed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.