CVE-2026-54911 Details
Description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.
A vulnerability exists in UltraJSON versions through 5.12.1, allowing the JSON encoding functions ujson.dumps(), ujson.dump(), and ujson.encode() to accept malformed or truncated UTF-8 byte sequences. When the reject_bytes option is set to False, these functions silently rewrite invalid byte sequences into different Unicode characters instead of rejecting them. This behavior creates a bypass of input validation and leads to data integrity issues. The vulnerability has been addressed in UltraJSON version 5.13.0.
Upgrade to UltraJSON version 5.13.0, which includes the necessary validation checks to prevent this vulnerability. The updated version can be downloaded from the UltraJSON GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf | [email protected] | Patch |
| https://github.com/ultrajson/ultrajson/releases/tag/5.13.0 | [email protected] | ProductRelease Notes |
| https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2 | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ultrajson project ultrajson | < 5.13.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |