UltraJSON has a Memory Leak parsing large integers allows DoS
Summary
ujson 5.4.0 to 5.11.0 inclusive contain an accumulating memory leak in JSON parsing large (outside of the range [-2^63, 2^64 - 1]) integers.
Exploitability
Any service that calls ujson.load()/ujson.loads()/ujson.decode() on untrusted inputs is affected and vulnerable to denial of service attacks.
Details
The leaked memory is a copy of the string form of the integer plus an additional NULL byte. The leak occurs irrespective of whether the integer parses successfully or is rejected due to having more than sys.get_int_max_str_digits() digits, meaning that any sized leak per malicious JSON can be achieved provided that there is no limit on the overall size of the payload.
ujson.loads(str(2 ** 64 - 1)) # No leak
ujson.loads(str(2 ** 64)) # Leaks
ujson.loads(str(10 ** sys.get_int_max_str_digits())) # Leaks and raises ValueErrorFix
The leak is fixed in ujson 5.12.0 (4baeb950df780092bd3c89fc702a868e99a3a1d2). There are no workarounds beyond upgrading to an unaffected version.
Credits
Discovered by Cameron Criswell/Skevros using Coverage-guided fuzzing (libFuzzer + AddressSanitizer)
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | ujson | >= 5.4.0, < 5.12.0 | 5.12.0 |
References
- https://access.redhat.com/security/cve/CVE-2026-32874
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32874.json
- https://github.com/ultrajson/ultrajson/releases/tag/5.12.0
- https://github.com/ultrajson/ultrajson/security/advisories/GHSA-wgvc-ghv9-3pmm
- https://bugzilla.redhat.com/show_bug.cgi?id=2449411
- https://github.com/ultrajson/ultrajson/commit/4baeb950df780092bd3c89fc702a868e99a3a1d2
- https://nvd.nist.gov/vuln/detail/CVE-2026-32874
- https://github.com/ultrajson/ultrajson
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-401- Platform
- Python (PyPI)
- Package
ujson- Disclosed
- 18.03.2026
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2291 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-wgvc-ghv9-3pmm - CC BY 4.0
Vulnerability history: ujson
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 7
- First → latest
- 01.2022 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 4
- Medium 3
Disclosures per year
- 2022: 3
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 4
-
UltraJSON has a Memory Leak parsing large integers allows DoS this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.