UltraJSON versions 5.10 through 5.11.0 are susceptible to a denial of service vulnerability that can crash the Python interpreter or induce infinite loops via unvalidated input.

This vulnerability involves integer overflow and underflow conditions within the C-based JSON processing logic, triggered when the indent parameter is manipulated by an unauthenticated attacker to exceed memory reservation limits.

The flaw poses a significant risk to application availability, as an attacker can trigger a segmentation fault or resource exhaustion through crafted JSON inputs. Given the CVSS score of 7.5, this high severity vulnerability could result in widespread service disruption for applications relying on ujson for data serialization or deserialization.

Immediate Action: Update the ujson package to version 5.12.0 or later to include the necessary integer overflow checks.

Proactive Monitoring: Monitor application logs for repeated segmentation faults or unexpected spikes in CPU usage associated with JSON processing functions.

Compensating Controls: Implement strict input validation to ensure the indent parameter provided to ujson functions is a non-negative integer within a reasonable range.

Public Exploit Available: Unknown.

The potential for unauthenticated denial of service makes this vulnerability a high priority for any environment processing untrusted JSON data. Organizations should prioritize updating to version 5.12.0 immediately to eliminate the underlying integer overflow condition and restore service stability.