CVE-2026-32875 is a high-severity Denial of Service (DoS) vulnerability affecting UltraJSON versions 5.10 through 5.11.0. This flaw allows remote, unauthenticated attackers to crash the Python interpreter or induce an infinite loop by manipulating the `indent` parameter during JSON serialization, stemming from integer overflow/underflow issues. Rated 7.5 CVSS, it has a network attack vector and low complexity, requiring no user interaction or privileges. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.1.0, < 5.12.0CPE matchmatch criteria | cpe:2.3:a:ultrajson_project:ultrajson:*:*:*:*:*:python:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
UltraJSON vulnerabilities
Apr 28, 2026ultrajson: UltraJSON: Denial of Service via large indent parameter in JSON serialization
Mar 20, 2026UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
Mar 18, 2026