---
id: CVE-2026-54911
aliases:
  - GHSA-3j69-69wj-xqx2
  - PYSEC-2026-2294
title: >-
  UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in
  ujson.dumps()
summary: >-
  UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in
  ujson.dumps()
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
vendor: ujson
product: ujson
ecosystem: pip
affected:
  - ujson < 5.13.0
patched:
  - ujson 5.13.0
published: '2026-06-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:55.310105853Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3j69-69wj-xqx2'
references:
  - url: >-
      https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54911'
  - url: >-
      https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/ujson/PYSEC-2026-2294.yaml
  - url: 'https://github.com/ultrajson/ultrajson'
  - url: 'https://github.com/ultrajson/ultrajson/releases/tag/5.13.0'
  - url: 'https://github.com/advisories/GHSA-3j69-69wj-xqx2'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00371
epssPercentile: 0.2829
cwe:
  - CWE-20
ingestedAt: '2026-06-22T13:35:24.395Z'
---

## Overview

### Summary
`ujson.dumps()` (or `ujson.dump()` or `ujson.encode()`) have a `reject_bytes=False` option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues.

### Details

The expected behavior is that for `x` being any bytes string, `x == ujson.loads(ujson.dumps(x, reject_bytes=False)).encode(errors="surrogatepass")` should always either be true or `ujson.dumps()` will throw an exception. In reality, some strings which should've been errors are silently rewritten as other strings:

* Invalid continuation bytes are replaced with valid ones: `b'\xcf\x13'` -> `b'\xcf\x93'`
* Unterminated sequence completes the sequence: `b'\xc3'` -> `b'\xc3\x80'`
* ... or leads to reading past the end of string: `b'\xf0\x90\x94'` -> `b"\xf0\x90\x94\x80inxcontrib'"`

### Impact

An application relying on reject_bytes=False for UTF-8 handling may experience:

- Data integrity issues
- Experience validation bypass if said validation occurs before serialisation

### Remediation

The missing/broken UTF-8 validation checks were added/fixed in https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf. We recommend upgrading to [UltraJSON 5.13.0](https://github.com/ultrajson/ultrajson/releases/tag/5.13.0).

### Workarounds

Decoding bytes to strings in Python before passing them to `ujson.dumps()` avoids this issue.

## Affected packages

- `ujson < 5.13.0`

## Remediation

Upgrade to a patched release:

- `ujson 5.13.0`