CVE-2026-54911
Description
From CVE.org
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.
Statement
ujson.dumps()/dump()/encode() prior to 5.13.0 have a reject_bytes=False option; when a caller explicitly sets it and passes raw bytes (not decoded str) input, malformed or truncated UTF-8 sequences are silently rewritten into different Unicode characters instead of being rejected, causing data integrity issues. This is not default behavior — it requires the calling application to opt into the permissive reject_bytes=False mode with byte input. Investigated Red Hat consumers of ujson either use the library-default safe reject_bytes=True on non-bytes (dict/str) input, or only pull ujson in transitively via a code path (e.g. FastAPI's UJSONResponse) that is never actually invoked, and are marked not affected. Red Hat OpenShift AI Jupyter workbench images are marked affected because they expose an interactive Python environment where arbitrary user notebook code can call the vulnerable API directly. CVSS: Red Hat's score (5.3) differs from the upstream CVE.org score (6.5) in the Confidentiality metric (N vs L) — the vulnerability causes silent data-integrity corruption, not any confidentiality/information-disclosure impact, so C:N is a more accurate reflection of the flaw's actual effect.
Mitigation
Upgrade ujson to 5.13.0 or later. Applications should avoid passing raw bytes to ujson.dumps()/dump()/encode() with reject_bytes=False; decoding bytes to str before encoding avoids the issue entirely.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat CVSS v3 Score Explanation
Lowered from CVEORG's C:L to C:N: the vulnerability (ujson.dumps()/dump()/encode() silently rewriting malformed/truncated UTF-8 bytes into different Unicode characters when reject_bytes=False is explicitly set) is a data-integrity issue, not a confidentiality one — no information disclosure or data exposure is described anywhere in the advisory. Score: 5.3 (Moderate), matching the assigned impact.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
An attacker could provide unexpected values and cause a program crash or arbitrary control of resource allocation, leading to excessive consumption of resources such as memory and CPU.
Confidentiality
Technical Impact: Read Memory; Read Files or Directories
An attacker could read confidential data if they are able to control resource references.
Integrity,Confidentiality,Availability
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
An attacker could use malicious input to modify data or possibly alter control flow in unexpected ways, including arbitrary command execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
