SECUFOCUSNOW
Home›CVE index›CVE-2026-32874
Review reviewHigh

CVE-2026-32874

ultrajson ultrajson, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large (outside of the range [-2^63, 2^64 - 1]) integers. The leaked memory is a copy of the string form of the integer plus an additional NULL byte. The leak occurs irrespective of whether the integer parses successfully or is rejected due to having more than sys.get_int_max_str_digits() digits, meaning that any sized leak per malicious JSON can be achieved provided that there is no limit on the overall size of the pa...

CVSS
7.5
EPSS
0.48%
38.8% percentile
CISA KEV
Not listed
Published
2026.03.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.48%
Technical severityCVSS 7.5

Vulnerability overview

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large (outside of the range [-2^63, 2^64 - 1]) integers. The leaked memory is a copy of the string form of the integer plus an additional NULL byte. The leak occurs irrespective of whether the integer parses successfully or is rejected due to having more than sys.get_int_max_str_digits() digits, meaning that any sized leak per malicious JSON can be achieved provided that there is no limit on the overall size of the pa...

Affected product and versions

Product
ultrajson ultrajson, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1
Affected versions
>= >= 5.4.0, < 5.12.0, >= 5.4.0 < 5.12.0
Fixed versions
5.12.0

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that ultrajson ultrajson, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-401, CWE-772