LiveActive security incident?Get immediate response
CVE Record

CVE-2021-45958: UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (call...

UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

UltraJSON is a JSON library used by Python applications. This CVE describes a stack-based buffer overflow during JSON encoding, triggered for example by excessive indentation. The provided sources do not confirm active exploitation, CVSS severity, or practical impact beyond the memory-safety flaw. Treat it as a dependency hygiene issue that may become urgent where untrusted input influences JSON formatting.

Executive priority

Prioritize remediation during normal dependency patch cycles, escalating for internet-facing or user-driven serialization services. There is enough evidence of a real memory-safety bug and vendor updates, but not enough evidence in the bundle to claim active exploitation or critical business urgency.

Technical view

CVE-2021-45958 affects UltraJSON, also known as ujson, through 5.1.0. The flaw is a stack-based buffer overflow in Buffer_AppendIndentUnchecked, reachable from encode. Public references include OSS-Fuzz findings, upstream issues, upstream PR 504, and Debian/Fedora security updates. The supplied bundle does not include CVSS, CWE, or a definitive exploitability assessment.

Likely exposure

Exposure is likely in applications or services that package UltraJSON/ujson through 5.1.0, including distro packages covered by Debian and Fedora advisories. Risk is higher if JSON encoding options can be influenced by users or external data. The source bundle lists affected product fields as unavailable, so inventory confirmation is required.

Exploitation context

The CVE description says exploitation can use a large amount of indentation, but the bundle does not show public weaponized exploit status. KEV is false, and no cited source here confirms active exploitation in the wild. The most defensible concern is process instability or memory corruption in exposed encoding paths.

Researcher notes

The strongest evidence is the CVE description, OSS-Fuzz linkage, upstream issue/PR references, and downstream Linux security updates. Missing evidence includes CVSS, CWE mapping, exact fixed upstream release, exploitability detail, and active exploitation confirmation. Avoid over-scoping beyond UltraJSON/ujson through 5.1.0 unless vendor advisories prove broader exposure.

Mitigation direction

  • Inventory direct and transitive UltraJSON/ujson dependencies across applications and images.
  • Upgrade affected ujson packages according to upstream, Debian, or Fedora guidance.
  • Prioritize services where external input can influence JSON encoding behavior.
  • If no upgrade path exists, reduce exposure of risky JSON formatting paths.
  • Track vendor advisories for the confirmed fixed package versions.

Validation and detection

  • Check package manifests and runtime environments for ujson versions through 5.1.0.
  • Review container and distro package inventories for Debian or Fedora ujson updates.
  • Identify code paths using ujson encode functionality with configurable indentation.
  • Confirm patched versions are deployed in production, not only in source repositories.
  • Monitor crash reports around JSON serialization after mitigation.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-45958 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
11Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.