CVE-2026-32874 Details
Description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large (outside of the range [-2^63, 2^64 - 1]) integers. The leaked memory is a copy of the string form of the integer plus an additional NULL byte. The leak occurs irrespective of whether the integer parses successfully or is rejected due to having more than sys.get_int_max_str_digits() digits, meaning that any sized leak per malicious JSON can be achieved provided that there is no limit on the overall size of the payload. Any service that calls ujson.load()/ujson.loads()/ujson.decode() on untrusted inputs is affected and vulnerable to denial of service attacks. This issue has been fixed in version 5.12.0.
A memory leak vulnerability has been identified in UltraJSON (ujson) versions 5.4.0 through 5.11.0. This vulnerability occurs during JSON parsing of large integers that fall outside the range of -2^63 to 2^64 - 1. The memory leak accumulates a copy of the string representation of the integer, along with an additional NULL byte. The issue arises regardless of whether the integer is successfully parsed or rejected for exceeding the maximum allowed digits. As a result, any size of memory leak can be exploited through malicious JSON payloads, leading to denial-of-service conditions. This vulnerability affects any service that processes untrusted JSON inputs using ujson's loading or decoding functions.
Users can upgrade to UltraJSON version 5.12.0, which addresses the memory leak vulnerability. Instructions for downloading this version are available on the UltraJSON GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
| CWE-772 | Missing Release of Resource after Effective Lifetime | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| ultrajson project ultrajson | >= 5.4.0, < 5.12.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |