https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T02:27:01.398778+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54911 CVE-2026-54911 — UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps() 2026-10-09T02:27:01.414393+00:00

Affected: ultrajson

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.