CVE catalog

CVE-2022-31116

ujson affected and fixed versions

[CVE catalog]

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.54% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixieujson5.10.0-1Fixed[CVE-2022-31116]
Debiantrixieujson5.4.0-1FixedDistribution-reported fixed boundary[CVE-2022-31116]
Debiansidujson5.13.0-1Fixed[CVE-2022-31116]
Debiansidujson5.4.0-1FixedDistribution-reported fixed boundary[CVE-2022-31116]
Debianforkyujson5.13.0-1Fixed[CVE-2022-31116]
Debianforkyujson5.4.0-1FixedDistribution-reported fixed boundary[CVE-2022-31116]
Debianbookwormujson5.4.0-1FixedDistribution-reported fixed boundary[CVE-2022-31116]
Debianbookwormujson5.7.0-1Fixed[CVE-2022-31116]

Showing 8 fix observations. All 20 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormujson5.4.0-1FixedDistribution-reported fixed boundary[CVE-2022-31116]
Debianbookwormujson5.7.0-1Fixed[CVE-2022-31116]
Debianforkyujson5.13.0-1Fixed[CVE-2022-31116]
Debianforkyujson5.4.0-1FixedDistribution-reported fixed boundary[CVE-2022-31116]
Debiansidujson5.13.0-1Fixed[CVE-2022-31116]
Debiansidujson5.4.0-1FixedDistribution-reported fixed boundary[CVE-2022-31116]
Debiantrixieujson5.10.0-1Fixed[CVE-2022-31116]
Debiantrixieujson5.4.0-1FixedDistribution-reported fixed boundary[CVE-2022-31116]
Opensuseleap 15.3python-ujson1.35-150100.3.5.1UnknownSource applicability is not established[SUSE-SU-2022:2673-1]
Opensuseleap 15.4python-ujson1.35-150100.3.5.1UnknownSource applicability is not established[SUSE-SU-2022:2673-1]
Suselinux enterprise module for development tools 15 sp3python-ujson1.35-150100.3.5.1UnknownSource applicability is not established[SUSE-SU-2022:2673-1]
Suselinux enterprise module for development tools 15 sp4python-ujson1.35-150100.3.5.1UnknownSource applicability is not established[SUSE-SU-2022:2673-1]
Suselinux enterprise module for package hub 15 sp3python-ujson1.35-150100.3.5.1UnknownSource applicability is not established[SUSE-SU-2022:2673-1]
Suselinux enterprise module for package hub 15 sp4python-ujson1.35-150100.3.5.1UnknownSource applicability is not established[SUSE-SU-2022:2673-1]
Ubuntuproujson1.35-3build1UnknownSource applicability is not established[USN-6629-3]
Ubuntuproujson1.35-3build2UnknownSource applicability is not established[USN-6629-3]
Ubuntuproujson1.35-4UnknownSource applicability is not established[USN-6629-3]
Ubuntuproujson1.35-4build1UnknownSource applicability is not established[USN-6629-3]
Ubuntuproujson1.35-4ubuntu0.1UnknownSource applicability is not established[USN-6629-3]
Ubuntuproujson1.35-4ubuntu0.1+esm1UnknownSource applicability is not established[USN-6629-3]
Original provider fields
{
  "package_releases": [
    {
      "name": "ujson",
      "status": "fixed",
      "release": "sid",
      "version": "5.13.0-1"
    },
    {
      "name": "ujson",
      "status": "fixed",
      "release": "forky",
      "version": "5.13.0-1"
    },
    {
      "name": "ujson",
      "status": "fixed",
      "release": "trixie",
      "version": "5.10.0-1"
    },
    {
      "name": "ujson",
      "status": "fixed",
      "release": "bookworm",
      "version": "5.7.0-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "ujson",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "5.4.0-1"
    },
    {
      "bug": null,
      "name": "ujson",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "5.4.0-1"
    },
    {
      "bug": null,
      "name": "ujson",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "5.4.0-1"
    },
    {
      "bug": null,
      "name": "ujson",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "5.4.0-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "ujson",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.35-4ubuntu0.1+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.35-3build1",
        "1.35-3build2",
        "1.35-4",
        "1.35-4build1",
        "1.35-4ubuntu0.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6629-3",
      "fixed_version": "1.35-4ubuntu0.1+esm1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6629-3",
      "provider_updated_at": "2026-04-27T17:04:58.569237Z",
      "applicability_unknown": true
    },
    {
      "name": "python-ujson",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.35-150100.3.5.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for development tools 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2673-1",
      "fixed_version": "1.35-150100.3.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2673-1",
      "provider_updated_at": "2026-02-04T04:38:34.523216Z",
      "applicability_unknown": true
    },
    {
      "name": "python-ujson",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.35-150100.3.5.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for development tools 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2673-1",
      "fixed_version": "1.35-150100.3.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2673-1",
      "provider_updated_at": "2026-02-04T04:38:34.523216Z",
      "applicability_unknown": true
    },
    {
      "name": "python-ujson",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.35-150100.3.5.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for package hub 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2673-1",
      "fixed_version": "1.35-150100.3.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2673-1",
      "provider_updated_at": "2026-02-04T04:38:34.523216Z",
      "applicability_unknown": true
    },
    {
      "name": "python-ujson",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.35-150100.3.5.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for package hub 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2673-1",
      "fixed_version": "1.35-150100.3.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2673-1",
      "provider_updated_at": "2026-02-04T04:38:34.523216Z",
      "applicability_unknown": true
    },
    {
      "name": "python-ujson",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.35-150100.3.5.1"
            }
          ]
        }
      ],
      "release": "leap 15.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2673-1",
      "fixed_version": "1.35-150100.3.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2673-1",
      "provider_updated_at": "2026-02-04T04:38:34.523216Z",
      "applicability_unknown": true
    },
    {
      "name": "python-ujson",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.35-150100.3.5.1"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2673-1",
      "fixed_version": "1.35-150100.3.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2673-1",
      "provider_updated_at": "2026-02-04T04:38:34.523216Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [python3-ujson]Unknown

    Source package: [ujson]

    Details (2)

    • 5.7.0-1 · amd64 · bookworm

      Fixed · Fixed: 5.4.0-1

      dsa · ujson · debian · bookworm

    • 5.7.0-1 · arm64 · bookworm

      Fixed · Fixed: 5.4.0-1

      dsa · ujson · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]