Security Bulletin:UltraJSON Malformed UTF-8 Byte Sequence Vulnerability

Summary UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into...

Astra Linux – Vulnerability in ujson

UltraJSON is a fast JSON encoder and decoder written in pure C, with bindings for Python 3.7+. It was found that affected versions incorrectly decoded certain characters. JSON strings containing escaped surrogate characters that were not part of a valid surrogate pair were decoded incorrectly. Th...

OESA-2026-3720 python-ujson security update

UltraJSON Security Fixes: UltraJSON aka ujson through 5.1.0 has a stack-based buffer overflow in BufferAppendIndentUnchecked called from encode. Exploitation can, for example, use a large amount of indentation.CVE-2021-45958 UltraJSON is a fast JSON encoder and decoder written in pure C with...

Astra Linux – Vulnerability in ujson

UltraJSON is a fast JSON encoder and decoder written in pure C, with bindings for Python 3.7+. Before version 5.12.1, when the ujsondump function wrote to a file-like object, and the write operation raised an exception, the serialized JSON string object was not decremented, resulting in memory...

OESA-2026-3608 python-ujson security update

UltraJSON Security Fixes: UltraJSON aka ujson through 5.1.0 has a stack-based buffer overflow in BufferAppendIndentUnchecked called from encode. Exploitation can, for example, use a large amount of indentation.CVE-2021-45958 UltraJSON is a fast JSON encoder and decoder written in pure C with...

OESA-2026-3607 python-ujson security update

UltraJSON Security Fixes: UltraJSON aka ujson through 5.1.0 has a stack-based buffer overflow in BufferAppendIndentUnchecked called from encode. Exploitation can, for example, use a large amount of indentation.CVE-2021-45958 UltraJSON is a fast JSON encoder and decoder written in pure C with...

OESA-2026-3606 python-ujson security update

UltraJSON Security Fixes: UltraJSON aka ujson through 5.1.0 has a stack-based buffer overflow in BufferAppendIndentUnchecked called from encode. Exploitation can, for example, use a large amount of indentation.CVE-2021-45958 UltraJSON is a fast JSON encoder and decoder written in pure C with...

UltraJSON 5.13.0-6-g733f9e1 Out-Of-Bounds Read

UltraJSON version 5.13.0-6-g733f9e1 suffers from an out of bounds read vulnerability. UltraJSON contains an out-of-bounds read in its native C JSON decoder when processing certain incomplete JSON values supplied through an explicitly length-bounded input buffer. The affected native entry point,...

Security Bulletin:UltraJSON Memory Leak Fix in ujson.dump() Prior to 5.12.1

Summary UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a memory leak in UltraJSON [CVE-2026-44660]

Summary IBM Watson Speech Services Cartridge is vulnerable to a memory leak in UltraJSON, due to an issue in ujson.dump that writes to a file-like object and the write operation raises an exception, causing the serialized JSON string object to not be decremented, leaking memory. CVE-2026-44660...

SUSE CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

Incorrect handling of invalid surrogate pair characters

ImpactWhat kind of vulnerability is it? Who is impacted?Anyone parsing JSON from an untrusted source is vulnerable.JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key...

PYSEC-2026-1057 Incorrect handling of invalid surrogate pair characters

Impact What kind of vulnerability is it? Who is impacted? Anyone parsing JSON from an untrusted source is vulnerable. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key...

Potential double free of buffer during string decoding

ImpactWhat kind of vulnerability is it? Who is impacted?When an error occurs while reallocating the buffer for string decoding, the buffer gets freed twice.Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. PatchesHas the problem been patched?...

Linux Distros Unpatched Vulnerability : CVE-2026-54911

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a...

CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

PYSEC-2026-2294

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

PYSEC-2026-2294

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

DEBIAN-CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...