Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-54911 →
DEBIAN-CVE-2026-54911
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
ujson
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
ujson
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
ujson
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.0-1"}]}]
Références
- advisory security-tracker.debian.org