CVE-2026-32874

CVE-2026-32874 describes an accumulating memory leak in UltraJSON versions 5.4.0 through 5.11.0, impacting services that parse untrusted JSON inputs containing large integers. This vulnerability, with a CVSS score of 7.5 (High), allows a remote attacker to trigger a denial of service through memory exhaustion with low attack complexity. The leak occurs irrespective of parsing success, meaning any sized leak can be achieved per malicious JSON payload. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.