CVE-2022-31117

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-415

Affected software

No affected versions have been published.

Timeline

Published
Jul 5, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-311185.3Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing CVE-2022-311194.9Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwordCVE-2022-31125.5An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks cCVE-2022-311202.7Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompleCVE-2022-311217.5Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus reCVE-2022-311228.1Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient ConfCVE-2022-311237.8Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in thCVE-2022-311246.5openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions CVE-2022-311259.8Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remoCVE-2022-311269.8Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remoCVE-2022-311276.1NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-maCVE-2022-311285.4Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not