The vulnerability arises from integer overflow/underflow in UltraJSON's handling of the 'indent' parameter in functions like ujson.dumps(). When the indent multiplied by the nested depth of the input exceeds INT32_MAX, a segmentation fault occurs. Additionally, large negative indent values can cause an infinite loop due to underflow. Exploitation requires control over the indent parameter with untrusted input and lack of restrictions on indent size. The maintainers fixed the issue in ujson 5.12.0 by promoting integer types to prevent overflow, skipping indentation code for negative indents, and capping indent at 1000. Workarounds include using fixed or no indentation or ensuring indent is non-negative and reasonably small.

Successful exploitation can cause denial of service by crashing the Python interpreter or causing it to hang in an infinite loop. There is no impact on confidentiality or integrity. The vulnerability requires that untrusted users control the indent parameter without restrictions. The CVSS v3.1 score is 7.5 (high) with attack vector network, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

A patch is available in ujson version 5.12.0 which fixes the integer overflow/underflow issues and caps the indent parameter to 1000. Users of python-lsp-server should upgrade to a version that includes this fixed ujson version (>=1.14.0_1). If upgrading is not possible, users should avoid passing untrusted or large indent values, use fixed or no indentation, and ensure indent is non-negative and below the threshold calculated as 2^31 divided by the maximum recursion depth.