PT-2026-26092 · Pypi · Ujson

Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-32874

OSV

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

ujson 5.4.0 to 5.11.0 inclusive contain an accumulating memory leak in JSON parsing large (outside of the range [-2^63, 2^64 - 1]) integers.

Exploitability

Any service that calls ujson.load()/ujson.loads()/ujson.decode() on untrusted inputs is affected and vulnerable to denial of service attacks.

Details

The leaked memory is a copy of the string form of the integer plus an additional NULL byte. The leak occurs irrespective of whether the integer parses successfully or is rejected due to having more than sys.get int max str digits() digits, meaning that any sized leak per malicious JSON can be achieved provided that there is no limit on the overall size of the payload.

ujson.loads(str(2 ** 64 - 1)) # No leak
ujson.loads(str(2 ** 64)) # Leaks
ujson.loads(str(10 ** sys.get int max str digits())) # Leaks and raises ValueError

Fix

The leak is fixed in ujson 5.12.0 (4baeb950df780092bd3c89fc702a868e99a3a1d2). There are no workarounds beyond upgrading to an unaffected version.

Credits

Discovered by Cameron Criswell/Skevros using Coverage-guided fuzzing (libFuzzer + AddressSanitizer)

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-32874

GHSA-WGVC-GHV9-3PMM

Affected Products

Ujson

References · 5

• https://osv.dev/vulnerability/GHSA-wgvc-ghv9-3pmm · Vendor Advisory
• https://github.com/ultrajson/ultrajson · Note
• https://github.com/ultrajson/ultrajson/security/advisories/GHSA-wgvc-ghv9-3pmm · Note
• https://github.com/ultrajson/ultrajson/releases/tag/5.12.0 · Note
• https://github.com/ultrajson/ultrajson/commit/4baeb950df780092bd3c89fc702a868e99a3a1d2 · Note