CVE-2026-32875

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32875", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-16T21:03:44.420Z", "datePublished": "2026-03-20T01:35:23.362Z", "dateUpdated": "2026-07-15T01:07:31.359Z"}, "containers": {"cna": {"title": "UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-835", "lang": "en", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c8rr-9gxc-jprv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c8rr-9gxc-jprv"}, {"name": "https://github.com/ultrajson/ultrajson/issues/700", "tags": ["x_refsource_MISC"], "url": "https://github.com/ultrajson/ultrajson/issues/700"}, {"name": "https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea", "tags": ["x_refsource_MISC"], "url": "https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea"}], "affected": [{"vendor": "ultrajson", "product": "ultrajson", "versions": [{"version": ">= 5.1.0, < 5.12.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T01:35:23.362Z"}, "descriptions": [{"lang": "en", "value": "UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0."}], "source": {"advisory": "GHSA-c8rr-9gxc-jprv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T14:32:02.675720Z", "id": "CVE-2026-32875", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:32:46.613Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "unaffected", "packageName": "python-ujson", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "unaffected", "packageName": "python-ujson", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:18.0"], "defaultStatus": "unaffected", "packageName": "python-ujson", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat"}], "datePublic": "2026-03-20T01:35:23.362Z", "descriptions": [{"lang": "en", "value": "A flaw was found in UltraJSON, a fast JSON encoder and decoder. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted large positive or negative indent value to the JSON serialization functions. This can lead to a buffer overflow, causing the Python interpreter to crash, or an infinite loop, making the application unresponsive. The issue stems from an integer overflow or underflow during memory allocation for indentation."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-32875"}, {"name": "RHBZ#2449400", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449400"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32875.json"}], "timeline": [{"lang": "en", "time": "2026-03-20T03:02:30.994Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-20T01:35:23.362Z", "value": "Made public."}], "title": "ultrajson: UltraJSON: Denial of Service via large indent parameter in JSON serialization", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:07:31.359Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32875", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T14:32:02.675720Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:32:38.548Z"}}], "cna": {"title": "UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop", "source": {"advisory": "GHSA-c8rr-9gxc-jprv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ultrajson", "product": "ultrajson", "versions": [{"status": "affected", "version": ">= 5.1.0, < 5.12.0"}]}], "references": [{"url": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c8rr-9gxc-jprv", "name": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c8rr-9gxc-jprv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ultrajson/ultrajson/issues/700", "name": "https://github.com/ultrajson/ultrajson/issues/700", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea", "name": "https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T01:35:23.362Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32875", "state": "PUBLISHED", "dateUpdated": "2026-03-25T14:32:46.613Z", "dateReserved": "2026-03-16T21:03:44.420Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T01:35:23.362Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ultrajson", "vendor": "ultrajson", "versions": [{"status": "affected", "version": ">= 5.1.0, < 5.12.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "unaffected", "packageName": "python-ujson", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "unaffected", "packageName": "python-ujson", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:18.0"], "defaultStatus": "unaffected", "packageName": "python-ujson", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ultrajson_project:ultrajson:*:*:*:*:*:python:*:*", "matchCriteriaId": "578A106C-655C-400C-B5EA-1BF5BD497EDE", "versionEndExcluding": "5.12.0", "versionStartIncluding": "5.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0."}, {"lang": "es", "value": "UltraJSON es un codificador y decodificador JSON r\u00e1pido escrito en C puro con enlaces para Python 3.7+. Las versiones 5.10 a 5.11.0 son vulnerables a desbordamiento de b\u00fafer o bucle infinito a trav\u00e9s del manejo de sangr\u00edas grandes. ujson.dumps() bloquea el int\u00e9rprete de Python (fallo de segmentaci\u00f3n) cuando el producto del par\u00e1metro de sangr\u00eda y la profundidad anidada de la entrada excede INT32_MAX. Tambi\u00e9n puede quedarse atascado en un bucle infinito si la sangr\u00eda es un n\u00famero negativo grande. Ambos son causados por un desbordamiento/subdesbordamiento de entero mientras se calcula cu\u00e1nta memoria reservar para la sangr\u00eda. Y ambos pueden usarse para lograr denegaci\u00f3n de servicio. Para ser vulnerable, un servicio debe llamar a ujson.dump()/ujson.dumps()/ujson.encode() mientras otorga a usuarios no confiables control sobre el par\u00e1metro de sangr\u00eda y no restringe esa sangr\u00eda a valores no negativos razonablemente peque\u00f1os. Un servicio tambi\u00e9n puede ser vulnerable al bucle infinito si utiliza una sangr\u00eda negativa fija. Un subdesbordamiento siempre ocurre para cualquier sangr\u00eda negativa cuando los datos de entrada est\u00e1n anidados al menos un nivel pero, para sangr\u00edas negativas peque\u00f1as, el subdesbordamiento suele ser rectificado accidentalmente por otro desbordamiento. Este problema ha sido corregido en la versi\u00f3n 5.12.0."}], "id": "CVE-2026-32875", "lastModified": "2026-07-15T02:20:01.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32875", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T14:32:02.675720Z", "version": "2.0.3"}}]}, "published": "2026-03-20T02:16:35.887", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/ultrajson/ultrajson/issues/700"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c8rr-9gxc-jprv"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-32875"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449400"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32875.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}, {"lang": "en", "value": "CWE-835"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-190"}], "source": "nvd@nist.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-190"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "ultrajson: UltraJSON: Denial of Service via large indent parameter in JSON serialization", "id": "2449400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449400"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in UltraJSON, a fast JSON encoder and decoder. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted large positive or negative indent value to the JSON serialization functions. This can lead to a buffer overflow, causing the Python interpreter to crash, or an infinite loop, making the application unresponsive. The issue stems from an integer overflow or underflow during memory allocation for indentation."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, applications utilizing `python-ujson` should ensure that the `indent` parameter in `ujson.dump()`, `ujson.dumps()`, or `ujson.encode()` functions is not controlled by untrusted input. If untrusted input must influence indentation, restrict the `indent` value to reasonably small, non-negative integers. Review application code to identify and validate all uses of the `indent` parameter with external data."}, "name": "CVE-2026-32875", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "python-ujson", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "python-ujson", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "python-ujson", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-03-20T01:35:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-32875\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32875\nhttps://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea\nhttps://github.com/ultrajson/ultrajson/issues/700\nhttps://github.com/ultrajson/ultrajson/security/advisories/GHSA-c8rr-9gxc-jprv"], "statement": "This is an IMPORTANT denial of service flaw in UltraJSON, affecting Red Hat products that utilize `python-ujson`, including various Community Projects and Red Hat OpenStack Platform. The vulnerability arises when applications process untrusted input that controls the `indent` parameter in JSON serialization functions, potentially leading to a Python interpreter crash or an infinite loop. Exploitation requires a service to explicitly expose the `indent` parameter to untrusted users without proper validation.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.1.0,5.12.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "ultrajson", "vendor": "ultrajson"}], "analysis": {"en": {"generated_at": "2026-03-23T16:29:27.632365+00:00", "value": {"mitigation_remediation": ["Upgrade to UltraJSON 5.12.0 or later."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via crash or infinite loop"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the UltraJSON project, specifically the ultrajson Python package. Versions 5.10 through 5.11.0, shipped for Python 3.7 and later, are vulnerable. Upgrading to version 5.12.0 or newer removes the issue.", "description_and_impact": "UltraJSON, a fast JSON encoder and decoder written in pure C, has a flaw in its handling of the indent parameter during dumps or encode operations. When the product of the indent value and the nested depth of the input data exceeds the maximum 32\u2011bit signed integer value, an integer overflow occurs, leading to a buffer overflow that crashes the Python interpreter. Additionally, supplying a large negative indent causes an integer underflow that can trap the encoder in an infinite loop. Both behaviors provide a route for an attacker to cause a denial of service. The weakness relates to integer overflows, buffer overflows, and uncontrolled loop termination (CWE\u2011190, CWE\u2011787, CWE\u2011835).", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity, and the low EPSS score (<1%) suggests that exploitation is not currently widespread. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires that an application accepts user\u2011controlled values for the indent parameter in ujson.dump(), ujson.dumps(), or ujson.encode() without validating or restricting it to small non\u2011negative values. A malicious user can supply a carefully crafted indent value to trigger a crash or hang, disabling the affected service."}}}}, "created": "2026-03-20T08:53:13.577482+00:00", "updated": "2026-03-25T14:09:41.174849+00:00", "vendors": ["ultrajson", "ultrajson$PRODUCT$ultrajson"]}