PYSEC-2026-2294

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/ujson/PYSEC-2026-2294.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-2294

Aliases

Published

2026-06-22T22:16:50.397Z

Modified

2026-07-13T07:15:45.403361942Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.

References

Affected packages

PyPI / ujson

Package

Name: ujson; View open source insights on deps.dev
Purl: pkg:pypi/ujson

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.13.0

Affected versions

1.*

1.4

1.6

1.8

1.9

1.15

1.18

1.19

1.21

1.22

1.23

1.30

1.33

1.34

1.35

2.*

2.0.0

2.0.1

2.0.2

2.0.3

3.*

3.0.0

3.1.0

3.2.0

4.*

4.0.0

4.0.1

4.0.2

4.1.0

4.2.0

4.3.0

5.*

5.0.0

5.1.0

5.2.0

5.3.0

5.4.0

5.5.0

5.6.0

5.7.0

5.8.0

5.9.0

5.10.0

5.11.0

5.12.0

5.12.1

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/ujson/PYSEC-2026-2294.yaml"