PT-2022-3515 · Ultrajson+6 · Ultrajson+6

Justanotherarchivist + 1 · Published 2022-07-05 · Updated 2025-05-17 · CVE-2022-31116

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions UltraJSON versions prior to 5.4.0

Description The issue is related to the improper decoding of certain characters in JSON strings, specifically escaped surrogate characters not part of a proper surrogate pair. This can lead to string corruption, key confusion, and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. The problem allows for potential data integrity impact.

Recommendations For versions prior to 5.4.0, upgrade to UltraJSON 5.4.0 to resolve the issue. As a temporary workaround, consider avoiding the use of UltraJSON for parsing JSON from untrusted sources until the upgrade is applied. There are no known safe alternatives to upgrading.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

ALT-PU-2022-2708

BDU:2022-04296

CVE-2022-31116

GHSA-WPQR-JCPX-745R

MGASA-2022-0270

OPENSUSE-SU-2022_2673-1

OPENSUSE-SU-2024:12183-1

OPENSUSE-SU-2025:15107-1

RHSA-2022:8850

RHSA-2022:8864

SUSE-SU-2022:2673-1

SUSE-SU-2022_2673-1

USN-6629-1

USN-6629-3

Affected Products

Alt Linux

Debian

Linuxmint

Red Os

Suse

Ubuntu

Ultrajson

References · 40

• 🔥 https://github.com/ultrajson/ultrajson/security/advisories/GHSA-wpqr-jcpx-745r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31116.json · Exploit
• https://github.com/ultrajson/ultrajson/commit/67ec07183342589d602e0fcf7bb1ff3e19272687 · Patch
• https://bdu.fstec.ru/vul/2022-04296 · Security Note
• https://osv.dev/vulnerability/USN-6629-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31116 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-31116 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0270 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-31116 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15107-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6629-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31116 · Security Note