{"id":"CVE-2026-54911","summary":"UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()","details":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.","aliases":["GHSA-3j69-69wj-xqx2","PYSEC-2026-2294"],"modified":"2026-07-15T15:52:59.094457Z","published":"2026-06-22T20:53:07.019Z","related":["CGA-f367-hjwv-q5gj"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54911.json"},"references":[{"type":"WEB","url":"https://github.com/ultrajson/ultrajson/releases/tag/5.13.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54911.json"},{"type":"ADVISORY","url":"https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54911"},{"type":"FIX","url":"https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ultrajson/ultrajson","events":[{"introduced":"0"},{"fixed":"1a23a68bbc5aff84e3f78f65011362cf3389693c"},{"fixed":"169eaf36b1116fece5034ee79a7a0ef3f6deedcf"}],"database_specific":{"cpe":"cpe:2.3:a:ultrajson_project:ultrajson:*:*:*:*:*:python:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.13.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["5.12.1","5.12.0","5.11.0","5.10.0","5.9.0","5.8.0","5.7.0","5.6.0","5.5.0","5.4.0","5.3.0","5.2.0","5.1.0","5.0.0","4.3.0","4.2.0","4.1.0","4.0.2","4.0.1","4.0.0","3.2.0","3.1.0","3.0.0","2.0.3","2.0.2","2.0.1","2.0.0","v1.35","v1.34"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54911.json","vanir_signatures_modified":"2026-07-15T15:52:59Z","vanir_signatures":[{"target":{"file":"src/ujson/lib/ultrajsondec.c","function":"decode_string"},"deprecated":false,"digest":{"function_hash":"202621309646466819243650859435479759111","length":4707},"id":"CVE-2026-54911-1ba50fda","signature_type":"Function","signature_version":"v1","source":"https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf","target":{"file":"src/ujson/lib/ultrajsonenc.c","function":"Buffer_EscapeStringValidated"},"deprecated":false,"digest":{"function_hash":"301418911564339236853002430134954153603","length":4363},"id":"CVE-2026-54911-605d024a"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf","target":{"file":"src/ujson/lib/ultrajsonenc.c"},"deprecated":false,"digest":{"line_hashes":["183356686465991657543968454615352760020","216624396578935828529190988019428788737","225986439972401945227232699573925747033","239436793528923148022997059891535692684","314169908770867073410235885105554691348","61952369377442215753842942794814250060","308396118214566931137410121468649898306","78542097989186174125166363124376193288","225629880217422800424367842891340668659","19410481681690746784091377088539146070","197157992881825332697941139432692290915","24729007628964650252180500868647821073","323818717674253734601967942692504240337","58780892605965652217667193137527538039","313392847737891028708223326163817585527","278921498631358056901314484452377605914","307328719378218029177167977555540508041","328613520901764627977465256970068630797","220099085178709560247011966194386339119","6544109849124358725178157618573165670","291850585735821742303304925047481620472","225629880217422800424367842891340668659","19410481681690746784091377088539146070","197157992881825332697941139432692290915","113165883423682887530862359483217953660","308535338731952697559922003104541471776","138159681411243518554119539526431104224","35801856043602795738753192212980094344","166791125187405989062185510977810929660","202487193614678491504040639271766102413","33847549388412089010167325700912793649","196238276339567255954669125177791501250","168971611491434606618324579192498797383","296408806923738489611725998361220168582","225629880217422800424367842891340668659","19410481681690746784091377088539146070","224215170243603256319363468638032920094","309573676307503691532454082653554525814","123373765476412738366787211044345708925","263104866661036091654666963903361686346","61244480925647787680873627755084990571","6023633919025188748677291944149995304","59995588160906581314279456833853792665"],"threshold":0.9},"id":"CVE-2026-54911-cf01a4e0"},{"deprecated":false,"digest":{"line_hashes":["61481268627701308587471944238297797995","255742195461137378269970914111607734063","31225772365792635901844896752134988210","211966799795300545858895841143077196764","151747333764570602615526167634749269660","262483871725234123578935494882417481646","233957078391859710991655723075139422612","339067184866058804308444017750064762913","176383592832049596714502255493947393828","242591874970349707558124265200327439585","338029387652670975555658015067779412221","332713471348858151646098004682020589953"],"threshold":0.9},"id":"CVE-2026-54911-ec576ef4","signature_type":"Line","signature_version":"v1","source":"https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf","target":{"file":"src/ujson/lib/ultrajsondec.c"}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}