Python lsp server: UltraJSON has a Memory Leak parsing large integers allows DoS (CVE-2026-32874)
A memory leak vulnerability exists in the UltraJSON (ujson) library versions 5.4.0 through 5.11.0 when parsing large integers outside the range [-2^63, 2^64 - 1]. This flaw can be triggered by any service using ujson to parse untrusted JSON inputs, potentially leading to denial of service (DoS). The leak involves accumulating copies of the string representation of large integers plus a null byte, regardless of whether parsing succeeds or fails. The issue is fixed in ujson version 5.12.0. No workarounds other than upgrading are available.
AI Analysis
Technical Summary
UltraJSON (ujson) versions 5.4.0 to 5.11.0 inclusive contain a memory leak vulnerability triggered by parsing large integers outside the range [-2^63, 2^64 - 1]. The leak occurs because the string form of the integer plus a null byte is accumulated in memory during JSON parsing, even if the integer is rejected due to exceeding digit limits. This affects any service calling ujson's load, loads, or decode functions on untrusted inputs, enabling denial of service attacks by exhausting memory. The vulnerability is resolved in ujson 5.12.0.
Potential Impact
The vulnerability allows an attacker to cause a denial of service by forcing the target service to leak memory when parsing specially crafted JSON containing large integers. This can lead to resource exhaustion and service disruption. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A fix is available in ujson version 5.12.0. Users should upgrade to this version or later to remediate the memory leak. There are no known workarounds or temporary fixes; upgrading is the only effective mitigation.
Python lsp server: UltraJSON has a Memory Leak parsing large integers allows DoS (CVE-2026-32874)
Description
A memory leak vulnerability exists in the UltraJSON (ujson) library versions 5.4.0 through 5.11.0 when parsing large integers outside the range [-2^63, 2^64 - 1]. This flaw can be triggered by any service using ujson to parse untrusted JSON inputs, potentially leading to denial of service (DoS). The leak involves accumulating copies of the string representation of large integers plus a null byte, regardless of whether parsing succeeds or fails. The issue is fixed in ujson version 5.12.0. No workarounds other than upgrading are available.
CVSS v3.1
Score 7.5high
Affected software
pkg:brew/python-lsp-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
UltraJSON (ujson) versions 5.4.0 to 5.11.0 inclusive contain a memory leak vulnerability triggered by parsing large integers outside the range [-2^63, 2^64 - 1]. The leak occurs because the string form of the integer plus a null byte is accumulated in memory during JSON parsing, even if the integer is rejected due to exceeding digit limits. This affects any service calling ujson's load, loads, or decode functions on untrusted inputs, enabling denial of service attacks by exhausting memory. The vulnerability is resolved in ujson 5.12.0.
Potential Impact
The vulnerability allows an attacker to cause a denial of service by forcing the target service to leak memory when parsing specially crafted JSON containing large integers. This can lead to resource exhaustion and service disruption. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A fix is available in ujson version 5.12.0. Users should upgrade to this version or later to remediate the memory leak. There are no known workarounds or temporary fixes; upgrading is the only effective mitigation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-python-lsp-server-CVE-2026-32874
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6aac8e0155bf5e2cf5490381
Added to database: 09/18/2026, 01:04:01 UTC
Last enriched: 09/18/2026, 01:31:37 UTC
Last updated: 09/18/2026, 01:31:37 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.