CVE-2022-31116 — Always-Incorrect Control Flow Implementation in Ultrajson
Severity
7.5HIGHNVD
OSV5.5
EPSS
0.1%
top 78.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 5
Latest updateFeb 14
Description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrog…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages3 packages
Also affects: Fedora 35, 36