{"id":"CVE-2021-45958","aliases":["GHSA-fh56-85cw-5pq6","PYSEC-2022-25"],"url":"https://o3.security/vulnerability/CVE-2021-45958","summary":"UltraJSON vulnerable to Out-of-bounds Write","details":"UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.","published":"2022-01-01T00:15:08.813Z","modified":"2026-07-08T05:58:04.551067668Z","cvss":{"score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":3,"affectedPackages":[{"ecosystem":"PyPI","name":"ujson","fixedVersion":"5.2.0"}],"fix":{"url":"https://github.com/ultrajson/ultrajson/pull/504","label":"ultrajson/ultrajson#504"},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CN7W3GOXALINKFUUE7ICQIC2EF5HNKUQ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O6JUWQTJLA2CMG4CJN7DCUVSOXLZIIXL/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULX35TSWLBBIMEH44MUORPXYYRZKEDC6/"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/02/msg00023.html"},{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009"},{"type":"REPORT","url":"https://github.com/ultrajson/ultrajson/issues/501"},{"type":"FIX","url":"https://github.com/ultrajson/ultrajson/issues/502#issuecomment-1031747284"},{"type":"FIX","url":"https://github.com/ultrajson/ultrajson/pull/504"},{"type":"EVIDENCE","url":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ujson/OSV-2021-955.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:58:04.551067668Z"}}