No guarantee, but from what I understand the issue is with objects created by ctypes parsing only. I doubt that any json parser would use that: >>> import

No guarantee, but from what I understand the issue is with objects created by ctypes parsing only. I doubt that any json parser would use that: >>> import ctypes;x = ctypes.c_double.from_param(1e300);print(type(x)) <class 'CArgObject'> When repr'd, an sprintf call with a statically sized buffer of 256 bytes is used to produce a string: https://github.com/python/cpython/commit/d9b8f138b7df3b455b54653ca59f491b4840d6fa#diff-4e23b3237d0aa08bf4c434d75fab19200a80837bd147051fefccd98b7f2480faL500-L507 With 1e300, the resulting string doesn't fit into 256 bytes, thus overflowing the buffer. Exploitation might be interesting, as you (probably?) can only use numbers (ascii range 0x30-0x39): >>> len("%f" % 1e300) 308