CVE-2026-32874High· 7.5▾ TwilightUltraJSON has a Memory Leak parsing large integers allows DoS
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.5%
Last analysed / modified upstream
ujson 5.4.0 to 5.11.0 inclusive contain an accumulating memory leak in JSON parsing large (outside of the range [-2^63, 2^64 - 1]) integers.
Any service that calls ujson.load()/ujson.loads()/ujson.decode() on untrusted inputs is affected and vulnerable to denial of service attacks.
The leaked memory is a copy of the string form of the integer plus an additional NULL byte. The leak occurs irrespective of whether the integer parses successfully or is rejected due to having more than sys.get_int_max_str_digits() digits, meaning that any sized leak per malicious JSON can be achieved provided that there is no limit on the overall size of the payload.
ujson.loads(str(2 ** 64 - 1)) # No leak
ujson.loads(str(2 ** 64)) # Leaks
ujson.loads(str(10 ** sys.get_int_max_str_digits())) # Leaks and raises ValueError
The leak is fixed in ujson 5.12.0 (4baeb950df780092bd3c89fc702a868e99a3a1d2). There are no workarounds beyond upgrading to an unaffected version.
Discovered by Cameron Criswell/Skevros using Coverage-guided fuzzing (libFuzzer + AddressSanitizer)
ujson >= 5.4.0, < 5.12.0Upgrade to a patched release:
ujson 5.12.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-32875High· 7.5UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
CVE-2026-44660High· 7.5UltraJSON has a Memory Leak in ujson.dump() on Write Failure
CVE-2022-31116High· 7.5Incorrect handling of invalid surrogate pair characters
CVE-2022-31117Medium· 5.9Potential double free of buffer during string decoding
CVE-2026-54911Medium· 6.5UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()