CVE-2026-54911

Published: Jun 22, 2026Modified: Jun 26, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.

Affected (1)

Products: Ultrajson Project: Ultrajson

Ultrajson Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ultrajson Project Ultrajson	Before 5.13.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf

Source: security-advisories@github.com

Patch

https://github.com/ultrajson/ultrajson/releases/tag/5.13.0

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2

Source: security-advisories@github.com

MitigationPatchVendor Advisory

Timeline

No history available yet.