CVE-2026-32874

🗓️ 20 Mar 2026 01:31:30Reported by Debian Security Bug TrackerType

UltraJSON leaks memory when parsing large integers, risking denial of service; fixed in version 5.12.0.

Reporter	Title	Published	Views	Family All 45
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a memory leak or buffer overflow in UltraJSON [CVE-2026-32874, CVE-2026-32875]	21 May 202615:13	–	ibm
IBM Security Bulletins	Security Bulletin: UltraJSON Memory Leak in Large Integer Parsing Enables Denial of Service	4 May 202612:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service (CVE-2026-32874, CVE-2026-32875)	25 Mar 202612:45	–	ibm
ATTACKERKB	CVE-2026-32874	20 Mar 202601:31	–	attackerkb
AlpineLinux	CVE-2026-32874	20 Mar 202601:31	–	alpinelinux
BDU FSTEC	The vulnerability of the Python programming language-based UltraJSON package lies in the lack of memory release after the effective lifespan, which allows a malicious actor to trigger a service failure.	13 Apr 202600:00	–	bdu_fstec
Chainguard	CVE-2026-32874 vulnerabilities	20 Mar 202601:17	–	cgr
Circl	CVE-2026-32874	22 Mar 202613:41	–	circl
CNNVD	UltraJSON 安全漏洞	20 Mar 202600:00	–	cnnvd
CVE	CVE-2026-32874	20 Mar 202601:31	–	cve

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	14	any	ujson	5.13.0-1	ujson_5.13.0-1_any.deb
Debian	999	any	ujson	5.13.0-1	ujson_5.13.0-1_any.deb
Debian	11	any	ujson	4.0.2-1	ujson_4.0.2-1_any.deb
Debian	13	any	ujson	5.10.0-1	ujson_5.10.0-1_any.deb
Debian	12	any	ujson	5.7.0-1	ujson_5.7.0-1_any.deb

20 Mar 2026 01:31Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.17.5

EPSS0.00479

SSVC