debian/ujson vulnerabilities

Latest debian/ujson CVEs

Newest publication first

1. CVE-2026-54911 UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

   Published 2026-06-22

   Medium·CVSS 6.5 EPSS 0.37%

   UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewri...

2. CVE-2026-44660 UltraJSON: Memory Leak in ujson.dump() on Write Failure

   Published 2026-05-27

   High·CVSS 8.7 EPSS 0.42%

   UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each fa...

3. CVE-2026-32875 UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

   Published 2026-03-20

   High·CVSS 7.5 EPSS 0.49%

   UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the...

4. CVE-2026-32874 UltraJSON has a Memory Leak parsing large integers allows DoS

   Published 2026-03-20

   High·CVSS 7.5 EPSS 0.51%

   UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large (outside of the range [-2^63, 2^64 - 1]) integers. The leaked memory is a copy of the string form...

5. CVE-2022-31116 Incorrect handling of invalid surrogate pair characters in ujson

   Published 2022-07-05

   High·CVSS 7.5 EPSS 2.5%

   UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly....

6. CVE-2022-31117 Double free of buffer during string decoding in ujson

   Published 2022-07-05

   Medium·CVSS 5.9 EPSS 1.9%

   UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, thi...

7. DLA-2929-1 ujson - security update

   Published 2022-02-26

   Unknown

8. CVE-2021-45958 UltraJSON vulnerable to Out-of-bounds Write

   Published 2021-12-31

   Medium·CVSS 5.5 EPSS 1.7%

   UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.