Описание
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.
Отчет
ujson.dumps()/dump()/encode() prior to 5.13.0 have a reject_bytes=False option; when a caller explicitly sets it and passes raw bytes (not decoded str) input, malformed or truncated UTF-8 sequences are silently rewritten into different Unicode characters instead of being rejected, causing data integrity issues. This is not default behavior — it requires the calling application to opt into the permissive reject_bytes=False mode with byte input. Investigated Red Hat consumers of ujson either use the library-default safe reject_bytes=True on non-bytes (dict/str) input, or only pull ujson in transitively via a code path (e.g. FastAPI's UJSONResponse) that is never actually invoked, and are marked not affected. Red Hat OpenShift AI Jupyter workbench images are marked affected because they expose an interactive Python environment where arbitrary user notebook code can call the vulnerable API directly. CVSS: Red Hat's score (5.3) differs from the upstream CVE.org score (6.5) in the Confidentiality metric (N vs L) — the vulnerability causes silent data-integrity corruption, not any confidentiality/information-disclosure impact, so C:N is a more accurate reflection of the flaw's actual effect.
Меры по смягчению последствий
Upgrade ujson to 5.13.0 or later. Applications should avoid passing raw bytes to ujson.dumps()/dump()/encode() with reject_bytes=False; decoding bytes to str before encoding avoids the issue entirely.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.
UltraJSON is a fast JSON encoder and decoder written in pure C with bi ...
UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
EPSS
5.3 Medium
CVSS3