CVE-2026-54911
Last modified
CVE-2026-54911 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ultrajson Project | Ultrajson | < 5.13.0 |
References
- https://github.com/ultrajson/ultrajson/releases/tag/5.13.0Product, Release Notes
- https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2Mitigation, Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-54911?
How severe is CVE-2026-54911?
How do I fix CVE-2026-54911?
Are you affected by CVE-2026-54911?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST