CVE-2026-32875: Ultrajson Buffer Overflow DoS Vulnerability

CVE-2026-32875 Overview

CVE-2026-32875 is an Integer Overflow vulnerability affecting UltraJSON (ujson), a high-performance JSON encoder and decoder written in pure C with Python 3.7+ bindings. The vulnerability exists in versions 5.10 through 5.11.0 and can be exploited to cause a denial of service through buffer overflow or infinite loop conditions when processing large indent values.

The flaw occurs when the ujson.dumps(), ujson.dump(), or ujson.encode() functions are called with a maliciously crafted indent parameter. When the product of the indent parameter and the nested depth of the input data exceeds INT32_MAX, an integer overflow occurs during memory reservation calculations for indentation. This can crash the Python interpreter with a segmentation fault or trigger an infinite loop with large negative indent values.

Critical Impact

Attackers can crash Python applications or cause infinite loops by supplying malicious indent parameters to ujson encoding functions, leading to denial of service conditions.

Affected Products

• UltraJSON (ujson) versions 5.10 through 5.11.0
• Python applications using vulnerable ujson versions for JSON encoding
• Services that allow untrusted users to control the indent parameter in ujson calls

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-32875 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-32875

Vulnerability Analysis

This vulnerability is rooted in improper integer handling within UltraJSON's indentation calculation logic. When ujson.dumps() or related encoding functions are invoked, the library calculates the memory needed for indentation based on the indent parameter multiplied by the nesting depth of the JSON structure.

The core issue is that this calculation does not properly validate the bounds of the resulting integer. When the indent value is extremely large (positive), multiplying it by the nesting depth can overflow INT32_MAX, causing undefined behavior that manifests as a segmentation fault and interpreter crash.

For negative indent values, an integer underflow occurs even with minimally nested data (one level deep). While small negative indents may be "accidentally rectified" by subsequent overflows in the calculation path, large negative values result in the library entering an infinite loop as it attempts to process an impossibly large or wrapped-around memory allocation size.

Applications are vulnerable if they expose ujson encoding functions to user-controlled input without properly validating the indent parameter to ensure it remains within reasonable, non-negative bounds.

Root Cause

The root cause is an integer overflow/underflow vulnerability (CWE-190) in UltraJSON's memory allocation calculations for indentation. The library multiplies the user-supplied indent parameter by the nesting depth without checking whether the result exceeds the bounds of a signed 32-bit integer. This leads to incorrect memory reservation, causing either a buffer overflow (segmentation fault) or an infinite loop during encoding operations.

Attack Vector

An attacker can exploit this vulnerability remotely by targeting any network-accessible service that:

1. Uses ujson.dump(), ujson.dumps(), or ujson.encode() for JSON serialization
2. Allows users to control the indent parameter (directly or indirectly)
3. Does not restrict indent values to small, non-negative integers

The attack requires no authentication or user interaction. An attacker simply needs to supply a crafted indent value—either an extremely large positive integer to trigger the overflow and crash, or a large negative integer to cause an infinite loop. When the vulnerable encoding function processes nested JSON data with this malicious indent, the service becomes unresponsive or terminates unexpectedly.

The vulnerability can manifest in two attack scenarios:

• Crash Attack: Using a large positive indent that, when multiplied by nesting depth, exceeds INT32_MAX, causing a segmentation fault
• Loop Attack: Using a large negative indent that causes an underflow, trapping the application in an infinite loop

Detection Methods for CVE-2026-32875

Indicators of Compromise

• Python application crashes with segmentation faults when processing JSON encoding requests
• Abnormally high CPU usage or unresponsive application threads during JSON serialization operations
• Log entries showing unexpected termination of Python interpreter processes
• Service timeouts or hangs specifically associated with JSON encoding operations

Detection Strategies

• Monitor for segmentation fault signals (SIGSEGV) in Python application logs and system crash reports
• Implement application-level logging to track indent parameter values passed to ujson encoding functions
• Set up alerting for CPU spike anomalies in services that heavily utilize JSON serialization
• Review application code for instances where user input flows to the indent parameter without validation

Monitoring Recommendations

• Deploy process monitoring to detect Python interpreter crashes and automatic restarts
• Configure watchdog timers to identify infinite loop conditions in JSON processing threads
• Implement request timeout mechanisms to prevent runaway encoding operations from consuming resources indefinitely
• Analyze application performance metrics for sudden degradation patterns associated with JSON serialization endpoints

How to Mitigate CVE-2026-32875

Immediate Actions Required

• Upgrade UltraJSON to version 5.12.0 or later immediately
• Audit all application code paths where ujson encoding functions receive user-controlled indent parameters
• Implement input validation to restrict indent values to small, non-negative integers (e.g., 0-8)
• Consider temporarily switching to the standard library json module if immediate patching is not feasible

Patch Information

The vulnerability has been fixed in UltraJSON version 5.12.0. The patch addresses the integer overflow/underflow in the indentation memory calculation logic. Organizations should update to this version or later to remediate the vulnerability.

For detailed information about the fix, refer to the GitHub Commit Update and the GitHub Security Advisory.

Workarounds

• Validate and sanitize all user input before passing to the indent parameter, ensuring only small non-negative integers are accepted
• Wrap ujson encoding calls in exception handlers and timeout mechanisms to prevent crashes from propagating and infinite loops from consuming resources
• Replace ujson with Python's standard library json module in code paths exposed to untrusted input
• Implement rate limiting on endpoints that perform JSON serialization to reduce the impact of potential exploitation attempts

# Upgrade ujson to patched version
pip install --upgrade ujson>=5.12.0

# Verify installed version
pip show ujson | grep Version