Double Free Vulnerability in UltraJSON (ujson) Prior to Version 5.4.0
Summary
CVE-2022-31117: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affects ujson versions < 9c20de0f77b391093967e25d01fb48671104b15b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UltraJSON, also known as ujson, is a high-performance JSON encoder and decoder implemented in pure C, designed for Python 3.7 and later. It is widely used for its speed and efficiency in handling JSON data, making it a popular choice among developers. However, certain versions of ujson prior to 5.4.0 contain a critical vulnerability that can lead to memory management issues.
Vulnerability Detail
The vulnerability arises from an error during the reallocation of a buffer used for string decoding, which can result in the buffer being freed twice. This double free condition is a serious memory management flaw that, while not easily triggered from Python due to the internal workings of UltraJSON's decoder, could potentially lead to application crashes or unexpected behavior if exploited in other contexts.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no known workarounds for this issue. The only effective solution is to upgrade to the fixed version.
Conclusion
The UltraJSON vulnerability (CVE-2022-31117) poses a significant risk due to a double free error in memory management. Users are strongly advised to upgrade to version 5.4.0 or later to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for ujson →
FAQ
The CVSS score for this vulnerability is 5.9, indicating a medium severity level.
All versions of UltraJSON prior to 5.4.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, after upgrading to version 5.4.0 or later, the vulnerability is resolved, and it is safe to use UltraJSON.
If an immediate upgrade is not possible, monitor your application closely for any unusual behavior, but be aware that there are no workarounds for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for ujson.
