CVE-2026-54911: UltraJSON UTF-8 Validation Bypass in reject_bytes Mode

Technical summary

CVE-2026-54911 affects UltraJSON versions before 5.13.0 and stems from improper handling of UTF-8 validation in the ujson.dumps(), ujson.dump(), and ujson.encode() functions when reject_bytes=False is set. The vulnerability allows malformed or truncated UTF-8 byte sequences to be silently rewritten into alternative valid Unicode characters rather than being rejected or raising an error. This violates the principle of strict input validation and can lead to canonical form attacks where data is transformed in unexpected ways, bypassing downstream validation logic that relies on input normalization.

Business impact

Organizations relying on UltraJSON for processing untrusted JSON data face risks of data integrity violations and input validation bypass. If security controls downstream assume JSON has been properly validated, an attacker could craft requests with malformed UTF-8 that serialize into benign-appearing but semantically different data, potentially evading signature-based filters, logging controls, or security event detection systems. The impact is most severe in environments where JSON payloads interact with strict data models, access control decisions, or audit trails.

Affected systems

Any application or service using UltraJSON (ultrajson Python package) versions prior to 5.13.0 is affected. This includes Python 3.7+ environments where ujson is installed as a dependency. Systems most at risk are those that process JSON from untrusted sources (web services, APIs, file uploads) and rely on encoding/decoding functions with the default reject_bytes parameter set to False.

Exploitability

The vulnerability requires no authentication and can be triggered remotely by providing a specially crafted JSON payload containing malformed UTF-8 sequences. However, exploitation requires that the application explicitly uses ujson for encoding/decoding untrusted data and that the reject_bytes option is set to False (or left at a vulnerable default). The attack surface depends on application design; not all uses of UltraJSON are equally exploitable. This is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no active exploitation in the wild has been reported to date.

Remediation

Upgrade UltraJSON to version 5.13.0 or later, which properly rejects malformed UTF-8 byte sequences. Verify the upgrade across all Python environments and virtual environments in your infrastructure. For temporary mitigation on older versions, review code to ensure reject_bytes is explicitly set to True if processing untrusted JSON data, though upgrading is the recommended path. Test applications after patching to confirm no behavioral changes.

Patch guidance

Consult the UltraJSON project advisory for the exact release version and availability. Patches should be applied to all development, staging, and production Python environments. Use dependency management tools (pip, Poetry, requirements.txt) to enforce the minimum version constraint of 5.13.0. Consider automating dependency updates through your CI/CD pipeline to prevent regression. Validate that applications do not explicitly set reject_bytes=False when processing untrusted input; the fixed version addresses the underlying encoding issue, but explicit override of validation flags should be reviewed.

Detection guidance

Monitor for use of UltraJSON versions prior to 5.13.0 via software composition analysis and dependency scanning tools. Within applications, log or alert on any ujson.dumps/dump/encode calls that explicitly pass reject_bytes=False, particularly in code paths handling external input. Network-level detection is difficult without deep packet inspection of JSON payloads; focus on inventory and code review. Check application logs for unexpected Unicode normalization or character substitution errors that might indicate payload transformation attempts.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The CVSS 3.1 score of 6.5 (MEDIUM) reflects the combination of network accessibility and integrity impact without confidentiality loss or availability impact. The absence from the KEV catalog suggests no active exploitation has been observed. Prioritization should be higher for systems processing hostile JSON (public APIs, file upload services) and lower for internal, trusted data flows. Organizations should patch within standard maintenance windows but do not require emergency incident response procedures.

Risk score, explained

The CVSS 3.1 score of 6.5 is driven by: Attack Vector: Network (AV:N) — no special access required; Attack Complexity: Low (AC:L) — the vulnerability is trivial to trigger if reject_bytes=False; Privileges Required: None (PR:N) — unauthenticated attackers can send malformed JSON; User Interaction: None (UI:N) — no user action needed; Scope: Unchanged (S:U) — impact is limited to the vulnerable component; Confidentiality: Low (C:L) — data transformation may reveal information about validation logic; Integrity: Low (I:L) — data is silently corrupted, reducing trust in outputs. Availability is not affected (A:N).

Frequently asked questions