UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8219-1 advisory.

    Cameron Criswell discovered that UltraJSON contained a memory leak that would occur when parsing large     integers. An attacker could possibly use this issue to cause UltraJSON to crash, resulting in a denial of     service. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32874)

    It was discovered that UltraJSON contained integer overflow/underflow issues when calculating how much     memory to reserve for indentation in certain instances. An attacker could possibly use this issue to cause     UltraJSON to crash, resulting in a denial of service. (CVE-2026-32875)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0f099ed388 advisory.

    Update to 5.12.0. This release updates the license field in the Python     metadata and fixes a buffer overflow/infinite loop from indent handling.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bf741e26e4 advisory.

    Update to 5.12.0. This release updates the license field in the Python     metadata and fixes a buffer overflow/infinite loop from indent handling.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions     5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling.
    ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter     and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the     indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how     much memory to reserve for indentation. And both can be used to achieve denial of service. To be     vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users     control over the indent parameter and not restrict that indentation to reasonably small non-negative     values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An     underflow always occurs for any negative indent when the input data is at least one level nested but, for     small negative indents, the underflow is usually accidentally rectified by another overflow. This issue     has been fixed in version 5.12.0. (CVE-2026-32875)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions
    5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling.
    ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter
    and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the
    indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how
    much memory to reserve for indentation. And both can be used to achieve denial of service. To be
    vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users
    control over the indent parameter and not restrict that indentation to reasonably small non-negative
    values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An
    underflow always occurs for any negative indent when the input data is at least one level nested but, for
    small negative indents, the underflow is usually accidentally rectified by another overflow. This issue
    has been fixed in version 5.12.0. (CVE-2026-32875)

ID	Name	Product	Family	Severity
310932	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : UltraJSON vulnerabilities (USN-8219-1)	Nessus	Ubuntu Local Security Checks	high
307435	Photon OS 5.0: Python3 PHSA-2026-5.0-0827	Nessus	PhotonOS Local Security Checks	high
307419	Photon OS 4.0: Python3 PHSA-2026-4.0-1000	Nessus	PhotonOS Local Security Checks	critical
303288	Fedora 42 : python-ujson (2026-0f099ed388)	Nessus	Fedora Local Security Checks	high
303283	Fedora 43 : python-ujson (2026-bf741e26e4)	Nessus	Fedora Local Security Checks	high
303240	Linux Distros Unpatched Vulnerability : CVE-2026-32875	Nessus	Misc.	high
438936	SCA: security update for ujson (GHSA-c8rr-9gxc-jprv)	Tenable Cloud Security	SCA Checks	high
438936	SCA: security update for ujson (GHSA-c8rr-9gxc-jprv)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-32875

high

Tenable Plugins

high

high

critical

high

high

high

high

high