{"action":"Upgrade ujson to 5.12.0 or later.","affected":[{"fixed":"5.12.0","introduced":"5.4.0"}],"component":"ujson","cve_ids":["CVE-2026-32874"],"ecosystem":"PyPI","epss":0.00497,"exploited":false,"fixed_versions":["5.12.0"],"ghsa_id":"GHSA-wgvc-ghv9-3pmm","id":"tcs_01M5KGYK64ARK2C14NM3THGTBV","modified_at":"2026-07-13T07:15:45.403362007Z","published_at":"2026-03-20T02:16:35.703Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2291","https://access.redhat.com/security/cve/CVE-2026-32874","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32874.json","https://github.com/ultrajson/ultrajson/releases/tag/5.12.0","https://github.com/ultrajson/ultrajson/security/advisories/GHSA-wgvc-ghv9-3pmm","https://bugzilla.redhat.com/show_bug.cgi?id=2449411","https://github.com/ultrajson/ultrajson/commit/4baeb950df780092bd3c89fc702a868e99a3a1d2"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-2291","url":"https://osv.dev/vulnerability/PYSEC-2026-2291"}],"summary":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large (outside of the ra"}