SECUFOCUSNOW
Home›CVE index›CVE-2026-32875
Review reviewHigh

CVE-2026-32875

ultrajson ultrajson, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve deni...

CVSS
7.5
EPSS
0.47%
38.1% percentile
CISA KEV
Not listed
Published
2026.03.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.47%
Technical severityCVSS 7.5

Vulnerability overview

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve deni...

Affected product and versions

Product
ultrajson ultrajson, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1
Affected versions
>= >= 5.1.0, < 5.12.0, >= 5.1.0 < 5.12.0
Fixed versions
5.12.0

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that ultrajson ultrajson, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-190, CWE-787, CWE-835
CVE-2026-32875 — ultrajson ultrajson, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 | SECUFOCUS NOW