simplejson before 2.6.1 vulnerable to array index error

🗓️ 06 Jul 2026 08:03:23Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 5 Views

Vulnerability in simplejson before two six one and Python json scanstring allows memory read via a negative index in raw_decode.

Reporter	Title	Published	Views	Family All 100
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in the version of Python shipped with the IBM Resilient virtual appliance (CVE-2017-1000158, CVE-2014-4616)	19 Apr 202121:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Python affect PowerKVM	18 Jun 201801:30	–	ibm
Amazon	Low: python-simplejson	9 Jul 201400:00	–	amazon
Amazon	Medium: python27	23 Jul 201400:00	–	amazon
Tenable Nessus	Amazon Linux AMI : python-simplejson (ALAS-2014-374)	12 Oct 201400:00	–	nessus
Tenable Nessus	Amazon Linux AMI : python27 (ALAS-2014-380)	12 Oct 201400:00	–	nessus
Tenable Nessus	CentOS 7 : python (CESA-2015:2101)	2 Dec 201500:00	–	nessus
Tenable Nessus	EulerOS Virtualization 3.0.1.0 : python (EulerOS-SA-2019-1434)	14 May 201900:00	–	nessus
Tenable Nessus	Fedora 21 : python3-3.4.1-16.fc21 (2014-14208)	11 Nov 201400:00	–	nessus
Tenable Nessus	Fedora 20 : python3-3.3.2-18.fc20 (2014-14245)	10 Nov 201400:00	–	nessus

Vulners

Node

pypi simplejsonRange0–2.6.1

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2014-4616
hackerone	www.hackerone.com/reports/12297
bugs	www.bugs.debian.org/cgi-bin/bugreport.cgi
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/simplejson/simplejson
security	www.security.gentoo.org/glsa/201503-10
bugs	www.bugs.python.org/issue21529
lists	www.lists.opensuse.org/opensuse-updates/2014-07/msg00015.html
openwall	www.openwall.com/lists/oss-security/2014/06/24/7
rhn	www.rhn.redhat.com/errata/RHSA-2015-1064.html

07 Jul 2026 11:31Current

6.8Medium risk

Vulners AI Score6.8

CVSS 35.9

CVSS 24.3

CVSS 3.15.9

EPSS0.08125