What is CVE-2022-31116?

CVE-2022-31116 is a high-severity vulnerability in Ultrajson, classified under Always-Incorrect Control Flow Implementation. CVSS score: 7.5/10. Published 2022-07-05.

How severe is CVE-2022-31116?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2022-31116 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Ultrajson

CVE-2022-31116

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.

Published 2022-07-05 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.025 (84.4th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 84.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.025 · newest: 0.025 · change: +0.001

Affected products

Ultrajson — versions < 5.4.0
Ultrajson Project
Fedoraproject Fedora — versions 35, 36

Weakness classification (CWE)

CWE-670 — Always-Incorrect Control Flow Implementation

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

github.com/ultrajson/ultrajson/security/advisories/GHSA-wpqr-jcpx-745r (Exploit, Third Party Advisory)
github.com/ultrajson/ultrajson/commit/67ec07183342589d602e0fcf7bb1ff3e19272687 (Patch, Third Party Advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)

Frequently asked questions

What is CVE-2022-31116?: CVE-2022-31116 is a high-severity vulnerability in Ultrajson, classified under Always-Incorrect Control Flow Implementation. CVSS score: 7.5/10. Published 2022-07-05.
How severe is CVE-2022-31116?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2022-31116 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.