# CVE-2026-54911: UltraJSON improper input validation in ujson.dumps UTF-8 handling

Source: https://junglewise.ai/threats/cve-2026-54911-ultrajson-improper-input-validation-in-ujson-dumps-utf-8-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-54911 · Severity: medium · CVSS 6.5 · Published 2026-06-22

UltraJSON is a high-performance library used by Python applications to process data in the JSON format. A flaw in how it handles certain text encoding settings allows malformed or incomplete data to be silently modified rather than rejected. This can lead to data corruption or allow attackers to bypass security filters that check data before it is saved or processed.

Technologies: [ujson (PyPI)](https://junglewise.ai/threats/technologies/ujson), [UltraJSON](https://junglewise.ai/threats/technologies/ultrajson). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [UltraJSON](https://junglewise.ai/threats/vendors/ultrajson).

## Quick answers

**Is CVE-2026-54911 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54911 being exploited in the wild.

**How severe is CVE-2026-54911?** Medium severity, with a CVSS score of 6.5, published 22 June 2026.

**Which products and versions are affected?** ujson (PyPI) <= 5.12.1, ECOSYSTEM:introduced=0,fixed=5.13.0; UltraJSON < 5.13.0, <= 5.12.1.

**Is there a fix for CVE-2026-54911?** Yes. ujson (PyPI): upgrade to 5.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54911 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54911?** Check whether you run ujson (PyPI) or UltraJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ujson (PyPI): upgrade to 5.13.0 or later

  ```sh
  pip install "ujson>=5.13.0"
  ```


## Technical details

A vulnerability exists in UltraJSON's C-based JSON encoder (ujson.dumps, ujson.dump, and ujson.encode) when the 'reject_bytes=False' parameter is enabled. The root cause is improper validation of UTF-8 sequences, including off-by-one errors in sequence detection, missing checks for codepoints exceeding the Unicode maximum, and failure to validate continuation bytes. An attacker can provide malformed or truncated UTF-8 sequences that the library silently rewrites into valid but unintended Unicode characters. This behavior can result in data integrity issues or the bypass of security sanitization logic that occurred prior to serialization. The issue is fixed in version 5.13.0 by tightening UTF-8 validation logic.

## Affected products

- ultrajson UltraJSON (ujson) < 5.13.0

## Identifiers

- CVE-2026-54911
- GHSA-3j69-69wj-xqx2
- PYSEC-2026-2294

## Timeline

- 2026-04-24: other: Initial fix commit authored
- 2026-06-14: patched: Version 5.13.0 released
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD

## References

- [https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf](https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf)
- [https://github.com/ultrajson/ultrajson/releases/tag/5.13.0](https://github.com/ultrajson/ultrajson/releases/tag/5.13.0)
- [https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2](https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2)

## Related threats

- [PYSEC-2026-1057 - Incorrect handling of invalid surrogate pair characters](https://junglewise.ai/threats/cve-2022-31116-incorrect-handling-of-invalid-surrogate-pair-characters)
- [PYSEC-2026-1056 - Potential double free of buffer during string decoding](https://junglewise.ai/threats/cve-2022-31117-potential-double-free-of-buffer-during-string-decoding)
- [UltraJSON memory leak in ujson.dump on write failure](https://junglewise.ai/threats/cve-2026-44660-ultrajson-memory-leak-in-ujson-dump-on-write-failure)
- [UltraJSON integer overflow in indent handling](https://junglewise.ai/threats/cve-2026-32875-ultrajson-integer-overflow-in-indent-handling)
- [UltraJSON memory leak in JSON parsing of large integers](https://junglewise.ai/threats/cve-2026-32874-ultrajson-memory-leak-in-json-parsing-of-large-integers)