UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

🗓️ 18 Mar 2026 13:01:24Reported by GitHub Advisory DatabaseType

UltraJSON dumps can crash or loop when indent times nesting depth overflows integer limits.

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a memory leak or buffer overflow in UltraJSON [CVE-2026-32874, CVE-2026-32875]	21 May 202615:13	–	ibm
IBM Security Bulletins	Security Bulletin: UltraJSON Memory Leak in Large Integer Parsing Enables Denial of Service	4 May 202612:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service (CVE-2026-32874, CVE-2026-32875)	25 Mar 202612:45	–	ibm
ATTACKERKB	CVE-2026-32875	20 Mar 202601:35	–	attackerkb
AlpineLinux	CVE-2026-32875	20 Mar 202601:35	–	alpinelinux
Chainguard	CVE-2026-32875 vulnerabilities	20 Mar 202601:17	–	cgr
Circl	CVE-2026-32875	22 Mar 202611:43	–	circl
CNNVD	UltraJSON 安全漏洞	20 Mar 202600:00	–	cnnvd
CVE	CVE-2026-32875	20 Mar 202601:35	–	cve
Cvelist	CVE-2026-32875 UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop	20 Mar 202601:35	–	cvelist

Vulners

Node

ujsonRange5.1.0–5.11.0pip

Source	Link
github	www.github.com/ultrajson/ultrajson/security/advisories/GHSA-c8rr-9gxc-jprv
github	www.github.com/ultrajson/ultrajson/issues/700
github	www.github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-32875
github	www.github.com/advisories/GHSA-c8rr-9gxc-jprv

20 Mar 2026 21:19Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

EPSS0.00072

SSVC