MEDIUM6.5PyPI
GHSA-3j69-69wj-xqx2· CVE-2026-54911, PYSEC-2026-2294UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
Modified: 9/10/2026
package
PyPI/ujson
pkg:pypi/ujson
HIGH7.5PyPI
GHSA-c38f-wx89-p2xg· CVE-2026-44660, PYSEC-2026-2293UltraJSON has a Memory Leak in ujson.dump() on Write Failure
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-c8rr-9gxc-jprv· CVE-2026-32875, PYSEC-2026-2292UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
Modified: 9/10/2026
MEDIUM5.5PyPI
GHSA-fh56-85cw-5pq6· CVE-2021-45958, PYSEC-2022-25UltraJSON vulnerable to Out-of-bounds Write
Modified: 11/18/2024
MEDIUM5.9PyPI
GHSA-fm67-cv37-96ff· CVE-2022-31117, PYSEC-2026-1056Potential double free of buffer during string decoding
Modified: 7/7/2026
HIGH7.5PyPI
GHSA-wgvc-ghv9-3pmm· CVE-2026-32874, PYSEC-2026-2291UltraJSON has a Memory Leak parsing large integers allows DoS
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-wpqr-jcpx-745r· CVE-2022-31116, PYSEC-2026-1057Incorrect handling of invalid surrogate pair characters
Modified: 7/7/2026
—PyPI
OSV-2021-1809Heap-buffer-overflow in ujson.cpython-38-x86_64-linux-gnu.so
Modified: 5/19/2022
—PyPI
OSV-2021-955Stack-buffer-overflow in Buffer_AppendIndentUnchecked
Modified: 5/19/2022
—PyPI
PYSEC-2022-25· CVE-2021-45958, GHSA-fh56-85cw-5pq6Modified: 11/8/2023
MEDIUM5.9PyPI
PYSEC-2026-1056· CVE-2022-31117, GHSA-fm67-cv37-96ffPotential double free of buffer during string decoding
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1057· CVE-2022-31116, GHSA-wpqr-jcpx-745rIncorrect handling of invalid surrogate pair characters
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-2291· CVE-2026-32874, GHSA-wgvc-ghv9-3pmmModified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2292· CVE-2026-32875, GHSA-c8rr-9gxc-jprvModified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2293· CVE-2026-44660, GHSA-c38f-wx89-p2xgModified: 7/13/2026
MEDIUM6.5PyPI
PYSEC-2026-2294· CVE-2026-54911, GHSA-3j69-69wj-xqx2Modified: 7/13/2026