CVE-2026-54911 UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

What is CVE-2026-54911?

CVE-2026-54911 is a medium-severity vulnerability in ultrajson, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.

Weakness: CWE-20

Which versions are affected by CVE-2026-54911?

3 open source packages ship an affected version, including ujson. It affects 1 product.

Products include Ultrajson Project Ultrajson.

How do I fix CVE-2026-54911?

Upgrade ujson to 5.13.0 or later.

Is CVE-2026-54911 being exploited?

There is no known exploitation of CVE-2026-54911 in the wild and no public exploit code.

Other vulnerabilities in ultrajson

• CVE-2026-44660 UltraJSON: Memory Leak in ujson.dump() on Write Failure High 8.7
• CVE-2026-32874 UltraJSON has a Memory Leak parsing large integers allows DoS High 7.5
• CVE-2026-32875 UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-54911, ECHO-0346-5369-6592, GHSA-3j69-69wj-xqx2, MINI-89q8-3p3r-9gwc, PYSEC-2026-2294, ROOT-APP-PYPI-CVE-2026-54911 and 1 more.