UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to
    5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they
    may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode
    characters instead of rejecting them. This leads to input validation bypass and data integrity issues.
    This vulnerability is fixed in 5.13.0. (CVE-2026-54911)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to     5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they     may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode     characters instead of rejecting them. This leads to input validation bypass and data integrity issues.
    This vulnerability is fixed in 5.13.0. (CVE-2026-54911)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
455222	Echo: ujson: security update to 5.13.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
455222	Echo: ujson: security update to 5.13.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
322239	Linux Distros Unpatched Vulnerability : CVE-2026-54911	Nessus	Misc.	Local	medium
443641	SCA: security update for ujson (GHSA-3j69-69wj-xqx2)	Tenable Cloud Security	SCA Checks	Local	medium
443641	SCA: security update for ujson (GHSA-3j69-69wj-xqx2)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-54911

medium

Tenable Plugins

medium

medium

medium

medium

medium