Back Linuxsecurity

Fedora 42 python-ujson 5.12.0 Buffer Overflow DoS Advisory 2026

Linuxsecurity •LinuxSecurity Advisories • March 22, 2026

UltraJSON is an ultra fast JSON encoder and decoder written in pure C with bindings for Python. Update Information : Update to 5.12.0. This release updates the license field in the Python metadata and fixes a buffer overflow/infinite loop from indent handling.

UltraJSON is an ultra fast JSON encoder and decoder written in pure C with

Update to 5.12.0. This release updates the license field in the Python metadata and fixes a buffer overflow/infinite loop from indent handling.

* Thu Mar 12 2026 Benjamin A. Beasley - 5.12.0-1 - Update to 5.12.0 (close RHBZ#2446884) * Thu Mar 12 2026 Benjamin A. Beasley - 5.11.0-9 - Use the provisional pyproject declarative buildsystem * Thu Mar 12 2026 Benjamin A. Beasley - 5.11.0-6 - Use a pkgconfig(\u2026) BR on double-conversion * Sat Jan 17 2026 Fedora Release Engineering - 5.11.0-2 - Rebuilt for

[ 1 ] Bug #2446884 - python-ujson-5.12.0 is available [ 2 ] Bug #2449471 - CVE-2026-32875 python-ujson: UltraJSON: Denial of Service via large indent parameter in JSON serialization [fedora-42] [ 3 ] Bug #2449472 - CVE-2026-32874 python-ujson: UltraJSON: Denial of Service due to memory leak when parsing large integers [fedora-42]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-0f099ed388' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical DoS Vulnerabilities in python-ujson Affect Fedora Users On March 20, 2026, two critical vulnerabilities (CVE-2026-32875 and CVE-2026-32874) were published affecting the python-ujson library, which is widely used for JSON encoding and decoding in Python applications. These vulnerabilities can lead to denial of service (DoS) attacks through a buffer overflow and infinite loop caused by large indent parameters during JSON serialization. Users of Fedora 42 and 43 are particularly affected, with updates released to address these issues. The vulnerabilities were reported to be exploitable, making it essential for users to apply the latest updates. The updates include version 5.12.0 of python-ujson, which fixes the identified issues. Users are advised to upgrade using the 'dnf' package manager to mitigate the risks associated with these vulnerabilities. The current status is that the vulnerabilities are patched, but users must ensure they have updated their systems. 2 sources 73

Extracted Entities

Fedora 42 python-ujson 5.12.0 Buffer Overflow DoS Advisory 2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)