CVE-2022-31116

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-670

Affected software

No affected versions have been published.

Timeline

Published: Jul 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-311175.9UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring CVE-2022-311185.3Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing CVE-2022-311194.9Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user password CVE-2022-31125.5An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks c CVE-2022-311202.7Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incomple CVE-2022-311217.5Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus re CVE-2022-311228.1Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Conf CVE-2022-311237.8Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in th CVE-2022-311246.5openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions CVE-2022-311259.8Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remo CVE-2022-311269.8Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remo CVE-2022-311276.1NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-ma