Description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.
References (4)
Core 4
Core References
Third Party Advisory x_refsource_confirm
https://github.com/ultrajson/ultrajson/security/advisories/GHSA-fm67-cv37-96ff
Patch, Third Party Advisory x_refsource_misc
https://github.com/ultrajson/ultrajson/commit/9c20de0f77b391093967e25d01fb48671104b15b
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/
Scores
CVSS v3
5.9
EPSS
0.0017
EPSS Percentile
38.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-415
Status
published
Products (4)
fedoraproject/fedora
35
fedoraproject/fedora
36
pypi/ujson
0 - 5.4.0PyPI
ultrajson_project/ultrajson
< 5.4.0
Published
Jul 05, 2022
Tracked Since
Feb 18, 2026