The vulnerability resides in UltraJSON versions 5.4.0 through 5.11.0 and is triggered when the decoder encounters integers larger than the permitted range of [-2^63, 2^64-1]. Each such integer adds a copy of its string representation plus a trailing null byte to the process’s memory, regardless of whether the integer is successfully parsed or is rejected because it exceeds sys.get_int_max_str_digits(). The effect is an accumulating memory leak that can grow without bound if the JSON payload contains arbitrarily large integers and has no enforced size limit. The result is that the application can run out of memory, become unresponsive, or crash, leading to a denial of service.

Any Python application that imports the ultrajson package and uses ujson.load, ujson.loads, or ujson.decode to process JSON data from an untrusted source is impacted. The affected releases are 5.4.0 to 5.11.0; earlier releases and version 5.12.0 or later are not affected.

The CVSS score of 7.5 indicates high severity, and the EPSS score of less than 1 % suggests that known exploitation attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog, implying limited public exploitation to date. However, the lack of authentication or privilege requirements means that an attacker can trigger the exploit simply by sending a crafted JSON payload with large integers to any vulnerable service. The main attack vector is the delivery of such a payload over an exposed interface, and once triggered the attacker can cause service disruption through memory exhaustion.