SB2026090543 - openEuler 24.03 LTS SP1 update for python-ujson

Description

This security bulletin contains information about 4 vulnerabilities.

1) Stack-based buffer overflow (CVE-ID: CVE-2021-45958)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Buffer_AppendIndentUnchecked. A remote unauthenticated attacker can trigger stack-based buffer overflow and cause a denial of service condition on the target system.

2) Integer overflow (CVE-ID: CVE-2026-32875)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow or underflow in ujson.dumps() indentation handling when processing user-controlled indent values during JSON serialization of nested input. A remote attacker can supply a specially crafted indent value to cause a denial of service.

The issue can result in a segmentation fault when the indent value and nesting depth exceed INT32_MAX, or an infinite loop when a large negative indent is used.

3) Memory leak (CVE-ID: CVE-2026-44660)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after effective lifetime in the objToJSONFile() function when handling write failures in ujson.dump() to a file-like object. A remote attacker can trigger repeated failed write operations to cause a denial of service.

Each failed write leaks the full size of the serialized JSON payload.

4) Input validation error (CVE-ID: CVE-2026-54911)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass input validation and alter serialized data integrity.

The vulnerability exists due to improper input validation in ujson.dumps(), ujson.dump(), and ujson.encode() when processing malformed or truncated UTF-8 byte sequences with reject_bytes=False. A remote attacker can supply crafted byte sequences to bypass input validation and alter serialized data integrity.

The issue occurs only when the reject_bytes=False option is used.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3607