Ultrajson vulnerabilities
We track 4 vulnerabilities in Ultrajson products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 27, 2026.
Latest Ultrajson vulnerabilities
- 7.5 High severity
ultrajson: Missing Release of Memory after Effective Lifetime
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, lea
- 7.5 High severity
ultrajson: Integer Overflow or Wraparound
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentat
- 7.5 High severity
ultrajson: Missing Release of Memory after Effective Lifetime
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large (outside of the range [-2^63, 2^64 - 1]) integers. The leaked memory is a copy
- 7.5 High severity
ultrajson: Always-Incorrect Control Flow Implementation
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were