PyPI/ujson CVE-2022-31117: medium 5.9, EPSS 1.88%

Potential double free of buffer during string decoding

Action: Upgrade ujson to 5.4.0 or later.

pip install ujson==5.4.0

Affected

Fixed versions

Sources

• osv: GHSA-fm67-cv37-96ff
• https://github.com/ultrajson/ultrajson/security/advisories/GHSA-fm67-cv37-96ff
• https://nvd.nist.gov/vuln/detail/CVE-2022-31117
• https://github.com/ultrajson/ultrajson/commit/9c20de0f77b391093967e25d01fb48671104b15b
• https://github.com/ultrajson/ultrajson
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7

CVE-2022-31117 · published 2022-07-05T21:05:59Z · modified 2026-07-07T11:56:23.468990297Z · JSON