VulertSecurity VulertSecurity

Vulnerability Database · PyPI · ujson · Version

ujson 4.3.0

4.3.0 is affected by 11 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 6.0.0.

Critical 0 High 5 Medium 5 Low 0 Unrated 1

All ujson versions & vulnerabilities → Source repository Search the database for this package →
Released 22 Nov 2021 Licence BSD-3-Clause Also known from other sources 10 Newer releases 43 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

ujson 4.3.0 vulnerabilities

11 vulnerabilities cover ujson 4.3.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-44660: UltraJSON Memory Leak on Write Failure in ujson.dump() 8.7 high 5.12.1 12 May 2026
CVE-2022-31116: ujson Package - Incorrect Handling of Invalid Surrogate Pair Characters 7.5 high 5.4.0 06 Jul 2026
CVE-2026-44660: ujson Memory Leak Vulnerability in JSON Serialization 7.5 high 5.12.1 27 May 2026
CVE-2022-31116: ujson - Incorrect handling of invalid surrogate pair characters 7.5 high 5.4.0 05 Jul 2022
CVE-2026-54911: ujson Package Input Validation Bypass and Data Integrity Issue 6.5 medium 5.13.0 22 Jun 2026
CVE-2026-54911: ujson Malformed UTF-8 Handling Vulnerability 6.5 medium 5.13.0 19 Jun 2026
CVE-2022-31117: ujson - Potential Double Free of Buffer During String Decoding 5.9 medium 5.4.0 06 Jul 2026
CVE-2022-31117: Potential double free of buffer during string decoding in ujson 5.9 medium 5.4.0 05 Jul 2022
CVE-2021-45958: UltraJSON Out-of-bounds Write Vulnerability 5.5 medium 5.2.0 21 Jan 2022
CVE-2021-45958: Stack-based Buffer Overflow in ujson N/A unrated 5.1.0 01 Jan 2022
Stack-buffer-overflow in Buffer_AppendIndentUnchecked in ujson N/A high f6860f1f3d8d4e92b9be0e5815355a8976c6e75b 11 Jul 2021

Looking for another version, or everything Vulert holds for ujson?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About ujson 4.3.0

Is ujson 4.3.0 vulnerable?

Yes. 11 vulnerabilities in the Vulert database cover ujson 4.3.0: 0 critical, 5 high, 5 medium and 0 low, plus 1 not yet rated. The upgrade Vulert recommends is 6.0.0, and each entry above names the fixed version to move to.

Which version of ujson should I use instead of 4.3.0?

6.0.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 4.3.0 the latest release of ujson?

No. 4.3.0 was published 22 Nov 2021, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor ujson for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the ujson version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.