7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32875

CVE-2026-32875: UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32875

CVE-2026-32875:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ujson	pip	>= 5.1.0, <= 5.11.0	5.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability originates from an integer overflow in the C implementation of the ultrajson library, triggered when a large or negative indent value is passed to functions like ujson.dumps(). The analysis of the patch commit 486bd4553dc471a1de11613bc7347a6b318e37ea reveals the root cause and the affected functions.

The execution flow of the vulnerability starts in the objToJSON function in src/ujson/python/objToJSON.c, which is the C-level entry point for the Python API. This function accepted the indent parameter without validation. The value was then used in the encode function (src/ujson/lib/ultrajsonenc.c) to calculate the necessary buffer size for pretty-printing the JSON. The calculation enc->indent * (enc->level + 1) was susceptible to an integer overflow if indent was a large number. This overflow resulted in Buffer_Reserve allocating a much smaller buffer than needed. Subsequently, when Buffer_AppendIndentUnchecked was called to write the indentation, it would write past the allocated buffer's boundary, causing a buffer overflow and a segmentation fault. A large negative indent could cause an underflow, leading to an infinite loop in the buffer resizing logic.

The patch addresses this by adding validation in objToJSON to cap the indent value at 1000 and by changing the integer types used in the calculation within encode from int to the larger ptrdiff_t to prevent the overflow.

Vulnerable functions

objToJSON

src/ujson/python/objToJSON.c

This is the C function that serves as the entry point for Python functions like `ujson.dumps()` and `ujson.encode()`. It is responsible for parsing the `indent` parameter from the Python call. Before the patch, this function passed the `indent` value to the encoding engine without any validation, allowing a maliciously large or negative value to be passed, which would trigger an integer overflow in the downstream code.

encode

src/ujson/lib/ultrajsonenc.c

This function is the core of the JSON encoding logic. The vulnerability lies in the calculation of the buffer size required for indentation (`enc->indent * (enc->level + 1)`). A large `indent` value caused an integer overflow in this multiplication, resulting in a much smaller buffer being allocated than required. This led to a subsequent buffer overflow or an infinite loop during the buffer resizing process.

Buffer_AppendIndentUnchecked

src/ujson/lib/ultrajsonenc.c

This function is responsible for writing the indentation spaces into the output buffer. When the `encode` function allocated an undersized buffer due to the integer overflow, this function would attempt to write beyond the buffer's allocated memory, causing an out-of-bounds write which leads to a segmentation fault.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.