Is CVE-2022-31116 actively exploited?

CVE-2022-31116 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2022-31116?

CVE-2022-31116 has a CVSS score of 7.5 (HIGH severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

How do I patch CVE-2022-31116?

Patch guidance is available from ultrajson project security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2022-31116.

Fix CVE-2022-31116 - HIGH ultrajson project ultrajson

Q: Which products are affected by CVE-2022-31116?

3 products: ultrajson project ultrajson, fedoraproject fedora, fedoraproject fedora.

Description

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Weaknesses: CWE-670

Metadata

Primary Vendor: ULTRAJSON_PROJECT
Published: 7/5/2022
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

ultrajson_project : ultrajsonfedoraproject : fedorafedoraproject : fedora

Remediation Guidance

Executive Summary

Cite this page

CVE-2022-31116. CVEDatabase.com. Retrieved 3 May 2026. https://cvedatabase.com/cve/CVE-2022-31116

View on NIST NVD

CVE-2022-31116 vulnerability