UltraJSON, a fast JSON encoder and decoder written in pure C, has a flaw in its handling of the indent parameter during dumps or encode operations. When the product of the indent value and the nested depth of the input data exceeds the maximum 32‑bit signed integer value, an integer overflow occurs, leading to a buffer overflow that crashes the Python interpreter. Additionally, supplying a large negative indent causes an integer underflow that can trap the encoder in an infinite loop. Both behaviors provide a route for an attacker to cause a denial of service. The weakness relates to integer overflows, buffer overflows, and uncontrolled loop termination (CWE‑190, CWE‑787, CWE‑835).

The vulnerability affects the UltraJSON project, specifically the ultrajson Python package. Versions 5.10 through 5.11.0, shipped for Python 3.7 and later, are vulnerable. Upgrading to version 5.12.0 or newer removes the issue.

The CVSS score of 7.5 indicates a high severity, and the low EPSS score (<1%) suggests that exploitation is not currently widespread. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an application accepts user‑controlled values for the indent parameter in ujson.dump(), ujson.dumps(), or ujson.encode() without validating or restricting it to small non‑negative values. A malicious user can supply a carefully crafted indent value to trigger a crash or hang, disabling the affected service.