CVE-2022-31117: ujson - Potential Double Free of Buffer During String Decoding
Summary
CVE-2022-31117: Potential double free of buffer during string decoding. Affects ujson versions < 5.4.0. Fixed in 5.4.0. How to fix ↓
Also tracked for
- ujson · Debian:11
The same CVE-2022-31117 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UltraJSON, commonly referred to as ujson, is a high-performance JSON encoding and decoding library for Python. It is designed to provide faster processing of JSON data compared to the standard library's json module. ujson is widely used in applications that require efficient data interchange, making it a critical component in many Python projects. However, like any software, it is not immune to vulnerabilities, which can affect its reliability and security.
Vulnerability Detail
The vulnerability identified as CVE-2022-31117 involves a potential double free of a buffer during the string decoding process in the ujson library. This issue arises when an error occurs while reallocating the buffer, leading to the buffer being freed twice. Although the internal workings of UltraJSON make it difficult to trigger this double free from Python, it still poses a risk in certain scenarios, potentially leading to memory corruption or application crashes.
How To Fix
Latest published version: 6.0.0 as of 23 Oct 2026
pip install --upgrade "ujson==6.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.4.0
This is the first release that contains the fix.
pip install --upgrade "ujson==5.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no workarounds available for this vulnerability. The only solution is to upgrade to the patched version of the library.
Conclusion
CVE-2022-31117 is a significant vulnerability in the ujson library that can lead to a double free of a buffer during string decoding. Users are strongly advised to upgrade to version 5.4.0 or later to ensure their applications remain secure. Regular monitoring for vulnerabilities using tools like Vulert can also help maintain the integrity of your software.
See every vulnerability recorded for ujson →
FAQ
CVE-2022-31117 is a vulnerability in the ujson library that can lead to a double free of a buffer during string decoding.
While the vulnerability is difficult to trigger from Python, it can still lead to memory corruption or crashes in applications using the affected version of ujson.
You should upgrade to UltraJSON version 5.4.0 or later to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for CVE-2022-31117 is 5.9, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for ujson.
