PT-2026-26092 · Ultrajson+2 · Ultrajson+2
Skevros
·
Published
2026-03-17
·
Updated
2026-04-28
·
CVE-2026-32874
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
UltraJSON versions 5.4.0 through 5.11.0
Description
UltraJSON, a fast JSON encoder and decoder written in C with Python 3.7+ bindings, contains an accumulating memory leak when parsing large integers (outside the range [-2^63, 2^64 - 1]) within JSON data. The leaked memory includes a copy of the integer's string representation plus an additional NULL byte. This leak occurs regardless of whether the integer is successfully parsed or rejected due to exceeding the maximum number of digits allowed by
sys.get int max str digits(). Consequently, a malicious JSON payload can trigger a memory leak of any size, provided there is no limit on the overall payload size. Any service utilizing the ujson.load()/ujson.loads()/ujson.decode() functions with untrusted input is susceptible to denial of service attacks. The vulnerability is triggered when processing large integer values within the JSON input.Recommendations
Versions 5.4.0 through 5.11.0 should be upgraded to version 5.12.0 or later.
Exploit
Fix
DoS
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Ubuntu
Ultrajson