UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode).

Summary

UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.

Timeline

1. Dec 31, 2021, 11:52 PM UTCCVE published
2. Aug 4, 2024, 4:54 AM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• ujsonPyPI

  From 1.34 · fixed in 5.2.0

• ujsonPyPI

  From 4.0.2 · fixed in 5.1.0

References 10