Medium severity5.9NVD Advisory· Published Jul 5, 2022· Updated Jun 17, 2026
CVE-2022-31117
CVE-2022-31117
Description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ujsonPyPI | < 5.4.0 | 5.4.0 |
Affected products
12cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
- ghsa-coords8 versionspkg:pypi/ujsonpkg:rpm/opensuse/python-ujson&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/python-ujson&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/python-ujson&distro=openSUSE%20Tumbleweedpkg:rpm/suse/python-ujson&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP3pkg:rpm/suse/python-ujson&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4pkg:rpm/suse/python-ujson&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP3pkg:rpm/suse/python-ujson&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP4
< 5.4.0+ 7 more
- (no CPE)range: < 5.4.0
- (no CPE)range: < 1.35-150100.3.5.1
- (no CPE)range: < 1.35-150100.3.5.1
- (no CPE)range: < 5.10.0-1.5
- (no CPE)range: < 1.35-150100.3.5.1
- (no CPE)range: < 1.35-150100.3.5.1
- (no CPE)range: < 1.35-150100.3.5.1
- (no CPE)range: < 1.35-150100.3.5.1
Patches
Vulnerability mechanics
References
8- github.com/ultrajson/ultrajson/commit/9c20de0f77b391093967e25d01fb48671104b15bnvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-fm67-cv37-96ffghsaADVISORY
- github.com/ultrajson/ultrajson/security/advisories/GHSA-fm67-cv37-96ffnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-31117ghsaADVISORY
- lists.fedoraproject.org/archives/list/[email protected]/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2ghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7ghsaWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7/nvd
News mentions
0No linked articles in our index yet.