CVE-2026-54911
Fixed in a distro release EPSS <1%CVSS 6.5
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.
Products: ultrajson
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ujson | 5.13.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | datahub-ingestion | 1.6.0-r4 |
| Chainguard | openstack-glance-2025.1 | 30.2.0_git20260616-r5 |
| Chainguard | openstack-glance-2025.1-fips | 30.2.0_git20260617-r2 |
| Chainguard | openstack-glance-2025.2 | 31.1.0_git20260617-r4 |
| Chainguard | openstack-glance-2025.2-fips | 31.1.0_git20260617-r3 |
| Chainguard | openstack-glance-2026.1 | 32.0.0_git20260625-r1 |
| Chainguard | openstack-glance-2026.1-fips | 32.0.0_git20260617-r4 |
| Chainguard | openstack-horizon-2025.1 | 25.3.2_git20260617-r3 |
| Chainguard | openstack-horizon-2025.1-fips | 25.3.2_git20260617-r2 |
| Chainguard | openstack-horizon-2025.2 | 25.5.2_git20260617-r3 |
| Chainguard | openstack-horizon-2025.2-fips | 25.5.2_git20260617-r3 |
| Chainguard | openstack-horizon-2026.1 | 25.7.3_git20260624-r2 |
| Chainguard | openstack-horizon-2026.1-fips | 25.7.3_git20260617-r2 |
| Chainguard | openstack-keystone-2025.1 | 27.0.1_git20260618-r5 |
| Chainguard | openstack-keystone-2025.1-fips | 27.0.1_git20260618-r5 |
| Chainguard | openstack-keystone-2025.2 | 28.0.1_git20260618-r4 |
| Chainguard | openstack-keystone-2025.2-fips | 28.0.1_git20260618-r2 |
| Chainguard | openstack-keystone-2026.1 | 29.0.1_git20260616-r5 |
| Chainguard | openstack-keystone-2026.1-fips | 29.0.1_git20260617-r3 |
| Chainguard | openstack-placement-2025.1 | 13.0.0_git20260617-r4 |
| Chainguard | openstack-placement-2025.1-fips | 13.0.0_git20260617-r3 |
| Chainguard | openstack-placement-2025.2 | 14.0.0_git20260617-r4 |
| Chainguard | openstack-placement-2025.2-fips | 14.0.0_git20260309-r3 |
| Chainguard | openstack-placement-2026.1 | 15.0.0_git20260617-r4 |
| Chainguard | openstack-placement-2026.1-fips | 15.0.0_git20260617-r2 |
| Debian 12 | ujson | no fix |
| Debian 13 | ujson | no fix |
| Debian 14 | ujson | 5.13.0-1 |
| Ubuntu 14.04 LTS | pandas | no fix |
| Ubuntu 16.04 LTS | collada2gltf | no fix |
| Ubuntu 16.04 LTS | pandas | no fix |
| Ubuntu 18.04 LTS | collada2gltf | no fix |
| Ubuntu 18.04 LTS | pandas | no fix |
| Ubuntu 20.04 LTS | pandas | no fix |
| Ubuntu 22.04 LTS | collada2gltf | no fix |
| Ubuntu 22.04 LTS | pandas | no fix |
| Ubuntu 24.04 LTS | pandas | no fix |
| Ubuntu 25.10 | pandas | no fix |
| Ubuntu 25.10 | ujson | no fix |
| Ubuntu 26.04 LTS | pandas | no fix |
| Ubuntu 26.04 LTS | ujson | no fix |
| Ubuntu 26.10 | pandas | no fix |
| Ubuntu 26.10 | ujson | no fix |
| Ubuntu Pro 16.04 LTS | ujson | no fix |
| Ubuntu Pro 18.04 LTS | ujson | no fix |
| Ubuntu Pro 20.04 LTS | ujson | no fix |
| Ubuntu Pro 22.04 LTS | ujson | no fix |
| Ubuntu Pro 24.04 LTS | ujson | no fix |