CVE-2021-45958

CVE-2021-45958 affects UltraJSON (ujson) up to version 5.1.0, with a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation could crash the application by using excessive indentation. Publicly documented references include Debian LTS (DLA-2929-1) and Mageia...

CVE-2022-31117

UltraJSON (ujson) has a vulnerability CVE-2022-31117: a double-free bug during buffer reallocation in string decoding. The issue is in the C-level decoder; due to UltraJSON’s internal design, this double free cannot be triggered from Python. The advisory details confirm the root cause and state n...

CVE-2022-31116

UltraJSON vulnerability (CVE-2022-31116) affects UltraJSON, a C-based JSON encoder/decoder with Python bindings. Affected versions improperly decoded escaped surrogate characters (surrogate pairs), enabling string corruption and potential key confusion or value overwriting when parsing JSON from ...

CVE-2026-32874

UltraJSON (ujson) for Python, C-based fast JSON encoder/decoder, is affected in versions 5.4.0–5.11.0 by a memory-leak in parsing large integers that fall outside [-2^63, 2^64-1]. The leak copies the integer’s string form plus an extra NULL byte and occurs regardless of whether the integer parses...

CVE-2026-32875

CVE-2026-32875 affects UltraJSON (Python bindings) and is evidenced across multiple feeds (Fedora advisories, IBM bulletin). The vulnerability resides in versions 5.10–5.11.0 where large indent handling can trigger an integer overflow/underflow when calculating memory for indentation, leading to ...

CVE-2026-44660

Summary of CVE-2026-44660 : UltraJSON’s ujson.dump() to a file-like object can leak memory if the underlying write() raises an exception. The root cause is that the temporary JSON string created during objToJSONFile() is not decremented on early return, causing memory growth proportional to the p...

CVE-2026-54911

CVE-2026-54911 (UltraJSON) : The vulnerability affects UltraJSON (C core with Python bindings) where ujson.dumps()/dump()/encode() with reject_bytes=False may accept malformed or truncated UTF-8, silently rewriting to other Unicode characters instead of rejecting. This enables input validation by...