Heap-buffer-overflow in ujson.cpython-38-x86_64-linux-gnu.so
Summary
OSV-2021-1809: Heap-buffer-overflow in ujson.cpython-38-x86_64-linux-gnu.so. Affects ujson across 2 version ranges.
< 550ba4d77294e61597a5259d00769c61281e0042
>= b9275f7b001da11495040f1332f6c3adf3daa57b, < f6860f1f3d8d4e92b9be0e5815355a8976c6e75b
Fixed in f6860f1f3d8d4e92b9be0e5815355a8976c6e75b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ujson package is a Python library that provides ultra-fast JSON encoding and decoding. It is commonly used to handle JSON data in Python applications. However, a vulnerability has been discovered in the ujson.cpython-38-x86_64-linux-gnu.so module, which can lead to a heap-buffer-overflow.
Vulnerability Detail
The vulnerability in ujson.cpython-38-x86_64-linux-gnu.so is a heap-buffer-overflow WRITE 1 issue. This vulnerability can be triggered under certain conditions, causing a crash in the ujson module. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service attack. The vulnerability has been reported and tracked in the OSS-Fuzz project.
How To Fix
Latest published version: 6.0.0 as of 23 Oct 2026
pip install --upgrade "ujson==6.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
f6860f1f3d8d4e92b9be0e5815355a8976c6e75b
This is the first release that contains the fix.
pip install --upgrade "ujson==f6860f1f3d8d4e92b9be0e5815355a8976c6e75b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by updating the ujson package to a patched version.
Conclusion
In conclusion, the ujson package is vulnerable to a heap-buffer-overflow issue in the ujson.cpython-38-x86_64-linux-gnu.so module. It is crucial to update the package to a patched version to mitigate the risk of exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ujson →
FAQ
ujson is a Python library for ultra-fast JSON encoding and decoding.
A heap-buffer-overflow is a type of memory vulnerability where a program writes data outside the bounds of a buffer allocated in the heap.
An attacker could exploit this vulnerability by crafting a malicious input that triggers the heap-buffer-overflow, potentially leading to arbitrary code execution or a denial-of-service attack.
No, only versions prior to f6860f1f3d8d4e92b9be0e5815355a8976c6e75b are affected. It is recommended to update to a patched version.
Yes, the vulnerability has been fixed in versions f6860f1f3d8d4e92b9be0e5815355a8976c6e75b and later.
References
Related vulnerabilities
Recent vulnerabilities recorded for ujson.
