VDB
DEBIAN-CVE-2022-31117
DEBIAN-CVE-2022-31117
PUBLISHED
CVSS 5.900000095367432 MEDIUM
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | ujson | 0, 0, 0 |
| Debian:13 | ujson | 0, 0, 0 |
| Debian:12 | ujson | 0, 0, 0 |
| Debian:11 | ujson | 5.2.0-1, 5.3.0-1, 5.4.0-1 |
Timeline
- Jul 5, 2022 CVE Published
- Apr 28, 2026 CVE Updated