This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-54911 →

DEBIAN-CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson...

Original description

The description as published by the source.

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ujson

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 ujson

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 ujson

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.0-1"}]}]

References

advisory security-tracker.debian.org