CVE-2026-54911

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54911", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T13:49:33.556Z", "datePublished": "2026-06-22T20:53:07.019Z", "dateUpdated": "2026-06-23T14:20:13.488Z"}, "containers": {"cna": {"title": "UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2"}, {"name": "https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf", "tags": ["x_refsource_MISC"], "url": "https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf"}, {"name": "https://github.com/ultrajson/ultrajson/releases/tag/5.13.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/ultrajson/ultrajson/releases/tag/5.13.0"}], "affected": [{"vendor": "ultrajson", "product": "ultrajson", "versions": [{"version": "< 5.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-22T20:53:07.019Z"}, "descriptions": [{"lang": "en", "value": "UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0."}], "source": {"advisory": "GHSA-3j69-69wj-xqx2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T14:19:57.855154Z", "id": "CVE-2026-54911", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T14:20:13.488Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T14:19:57.855154Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T14:20:09.998Z"}}], "cna": {"title": "UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()", "source": {"advisory": "GHSA-3j69-69wj-xqx2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "ultrajson", "product": "ultrajson", "versions": [{"status": "affected", "version": "< 5.13.0"}]}], "references": [{"url": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2", "name": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf", "name": "https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ultrajson/ultrajson/releases/tag/5.13.0", "name": "https://github.com/ultrajson/ultrajson/releases/tag/5.13.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-22T20:53:07.019Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54911", "state": "PUBLISHED", "dateUpdated": "2026-06-23T14:20:13.488Z", "dateReserved": "2026-06-16T13:49:33.556Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-22T20:53:07.019Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ultrajson", "vendor": "ultrajson", "versions": [{"status": "affected", "version": "< 5.13.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ultrajson_project:ultrajson:*:*:*:*:*:python:*:*", "matchCriteriaId": "A5802005-78C3-4A11-B9DE-1CCD143A155B", "versionEndExcluding": "5.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0."}], "id": "CVE-2026-54911", "lastModified": "2026-06-26T20:10:54.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54911", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T14:19:57.855154Z", "version": "2.0.3"}}]}, "published": "2026-06-22T22:16:50.397", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/ultrajson/ultrajson/releases/tag/5.13.0"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()", "id": "2491538", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491538"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-20", "details": ["UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0."], "mitigation": {"lang": "en:us", "value": "Upgrade ujson to 5.13.0 or later. Applications should avoid passing raw bytes to ujson.dumps()/dump()/encode() with reject_bytes=False; decoding bytes to str before encoding avoids the issue entirely."}, "name": "CVE-2026-54911", "public_date": "2026-06-22T20:53:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54911\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54911\nhttps://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf\nhttps://github.com/ultrajson/ultrajson/releases/tag/5.13.0\nhttps://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2"], "statement": "ujson.dumps()/dump()/encode() prior to 5.13.0 have a reject_bytes=False option; when a caller explicitly sets it and passes raw bytes (not decoded str) input, malformed or truncated UTF-8 sequences are silently rewritten into different Unicode characters instead of being rejected, causing data integrity issues. This is not default behavior \u2014 it requires the calling application to opt into the permissive reject_bytes=False mode with byte input. Investigated Red Hat consumers of ujson either use the library-default safe reject_bytes=True on non-bytes (dict/str) input, or only pull ujson in transitively via a code path (e.g. FastAPI's UJSONResponse) that is never actually invoked, and are marked not affected. Red Hat OpenShift AI Jupyter workbench images are marked affected because they expose an interactive Python environment where arbitrary user notebook code can call the vulnerable API directly. CVSS: Red Hat's score (5.3) differs from the upstream CVE.org score (6.5) in the Confidentiality metric (N vs L) \u2014 the vulnerability causes silent data-integrity corruption, not any confidentiality/information-disclosure impact, so C:N is a more accurate reflection of the flaw's actual effect.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ultrajson", "source": "cna", "vendor": "ultrajson"}, "product": "ultrajson", "vendor": "ultrajson"}], "created": "2026-06-22T23:45:04.363350+00:00", "updated": "2026-06-23T01:15:16.330164+00:00", "vendors": ["ultrajson", "ultrajson$PRODUCT$ultrajson"]}