Most recent entries from all

BREW-magic-wormhole-CVE-2026-54911 — UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

Affected: Homebrew: magic-wormhole

### Summary `ujson.dumps()` (or `ujson.dump()` or `ujson.encode()`) have a `reject_bytes=False` option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues.

### Details

The expected behavior is that for `x` being any bytes string, `x == ujson.loads(ujson.dumps(x, reject_bytes=False)).encode(errors="surrogatepass")` should always either be true or `ujson.dumps()` will throw an exception. In reality, some strings which should've been errors are silently rewritten as other strings:

* Invalid continuation bytes are replaced with valid ones: `b'\xcf\x13'` -> `b'\xcf\x93'` * Unterminated sequence completes the sequence: `b'\xc3'` -> `b'\xc3\x80'` * ... or leads to reading past the end of string: `b'\xf0\x90\x94'` -> `b"\xf0\x90\x94\x80inxcontrib'"`

### Impact

An application relying on reject_bytes=False for UTF-8 handling may experience:

- Data integrity issues - Experience validation bypass if said validation occurs before serialisation

### Remediation

The missing/broken UTF-8 validation checks were added/fixed in https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf. We recommend upgrading to [UltraJSON 5.13.0](https://github.com/ultrajson/ultrajson/releases/tag/5.13.0).

### Workarounds

Decoding bytes to strings in Python before passing them to `ujson.dumps()` avoids this…

EUVD-2026-329242

fkie_cve-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.

GHSA-3j69-69wj-xqx2 — UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

Affected: PyPI: ujson

### Details

### Impact

An application relying on reject_bytes=False for UTF-8 handling may experience:

- Data integrity issues - Experience validation bypass if said validation occurs before serialisation

### Remediation

### Workarounds

Decoding bytes to strings in Python before passing them to `ujson.dumps()` avoids this…

OESA-2026-3606 — python-ujson security update

Affected: openEuler:20.03-LTS-SP4: python-ujson

UltraJSON Security Fix(es):

UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.(CVE-2021-45958)

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.(CVE-2022-31116)

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.(CVE-2022-31117)

UltraJSON is a fast JSON encoder and decoder written in pure C wi…

PYSEC-2026-2294

Affected: PyPI: ujson

UBUNTU-CVE-2026-54911

Affected: Ubuntu:14.04:LTS: pandas, Ubuntu:16.04:LTS: collada2gltf, Ubuntu:16.04:LTS: pandas, Ubuntu:Pro:16.04:LTS: ujson, Ubuntu:18.04:LTS: collada2gltf, Ubuntu:18.04:LTS: pandas, Ubuntu:Pro:18.04:LTS: ujson, Ubuntu:20.04:LTS: pandas, Ubuntu:Pro:20.04:LTS: ujson, Ubuntu:22.04:LTS: collada2gltf and 8 more