{"schemaVersion":3,"id":"CVE-2026-54911","aliases":["GHSA-3j69-69wj-xqx2","PYSEC-2026-2294","UBUNTU-CVE-2026-54911","DEBIAN-CVE-2026-54911","CGA-2vmc-jxwf-7hf3","CGA-39g4-969f-r74p","CGA-3c4x-vgfm-97jx","CGA-3gc6-f5qx-78jx","CGA-4rmj-6ph9-j279","CGA-4w39-6c96-f79w","CGA-56v9-6ccq-wx3w","CGA-58fw-5w8r-m2rp","CGA-5fcw-v92g-2prr","CGA-5wpg-rg59-7gqh","CGA-6gvh-6r8g-q64p","CGA-6xr6-pjcm-9vx7","CGA-7c57-mcg8-h3j6","CGA-7f48-jf7f-v96m","CGA-8mmx-whfw-rvp9","CGA-8wh9-887p-39pq","CGA-cw45-w73r-5f57","CGA-f47q-694m-ff3j","CGA-f5rj-65qj-97x5","CGA-f66p-3fv7-vvr7","CGA-fhc9-fhqm-r22w","CGA-g22q-g344-mh39","CGA-g6pg-4mph-35m6","CGA-gxr8-6jh9-g944","CGA-h97w-22vf-vjhw","CGA-hg8h-376j-jfg5","CGA-hx9g-c4wg-7gv8","CGA-j847-9g84-7qgw","CGA-j8h2-g88m-2hv2","CGA-m78g-hg32-g59m","CGA-m8g9-6fr3-xvrq","CGA-mg6p-g9qf-p8qx","CGA-mmwr-3qq3-qvxw","CGA-mvmp-423m-6wcp","CGA-p5f8-xcwh-fchf","CGA-pf4m-pm9p-h5v3","CGA-qv66-r92j-gqqh","CGA-r53p-f9vr-4fg7","CGA-r9mh-jqx7-3w88","CGA-rrqp-h2f5-8wqp","CGA-v573-38jm-7vrx","CGA-v8wm-q987-vpq2","CGA-vmx6-pj97-pmhh","CGA-vp42-9hm8-gmq5","CGA-w7gc-x488-vw89","CGA-wcm6-5wf2-wm4p","CGA-x5ch-7x7x-5m3h","CGA-xg68-c5rx-wprx","CGA-xrcg-95p3-2xmc","CGA-xv94-c67v-8qc5"],"status":"published","duplicateOf":null,"title":null,"description":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.","dates":{"published":"2026-06-22T20:53:07.019Z","modified":"2026-06-23T14:20:13.488Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":10,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":10,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":10,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":10,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00371,"percentile":0.2962,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00371},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00371,"percentile":0.2962}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00371,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00371,"percentile":0.2962}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"}],"affected":[{"vendor":"chainguard","product":"datahub-ingestion","name":"datahub-ingestion","label":"datahub-ingestion","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datahub-ingestion","purlType":"apk","versions":[{"text":"< 1.6.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2025.1","name":"openstack-glance-2025.1","label":"openstack-glance-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2025.1","purlType":"apk","versions":[{"text":"< 30.2.0_git20260616-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 30.2.0_git20260616-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2025.1-fips","name":"openstack-glance-2025.1-fips","label":"openstack-glance-2025.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2025.1-fips","purlType":"apk","versions":[{"text":"< 30.2.0_git20260617-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 30.2.0_git20260617-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2025.2","name":"openstack-glance-2025.2","label":"openstack-glance-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2025.2","purlType":"apk","versions":[{"text":"< 31.1.0_git20260617-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.1.0_git20260617-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2025.2-fips","name":"openstack-glance-2025.2-fips","label":"openstack-glance-2025.2-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2025.2-fips","purlType":"apk","versions":[{"text":"< 31.1.0_git20260617-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.1.0_git20260617-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2026.1","name":"openstack-glance-2026.1","label":"openstack-glance-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2026.1","purlType":"apk","versions":[{"text":"< 32.0.0_git20260625-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 32.0.0_git20260625-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2026.1-fips","name":"openstack-glance-2026.1-fips","label":"openstack-glance-2026.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2026.1-fips","purlType":"apk","versions":[{"text":"< 32.0.0_git20260617-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 32.0.0_git20260617-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2025.1","name":"openstack-horizon-2025.1","label":"openstack-horizon-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2025.1","purlType":"apk","versions":[{"text":"< 25.3.2_git20260617-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.3.2_git20260617-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2025.1-fips","name":"openstack-horizon-2025.1-fips","label":"openstack-horizon-2025.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2025.1-fips","purlType":"apk","versions":[{"text":"< 25.3.2_git20260617-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.3.2_git20260617-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2025.2","name":"openstack-horizon-2025.2","label":"openstack-horizon-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2025.2","purlType":"apk","versions":[{"text":"< 25.5.2_git20260617-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.5.2_git20260617-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2025.2-fips","name":"openstack-horizon-2025.2-fips","label":"openstack-horizon-2025.2-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2025.2-fips","purlType":"apk","versions":[{"text":"< 25.5.2_git20260617-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.5.2_git20260617-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2026.1","name":"openstack-horizon-2026.1","label":"openstack-horizon-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2026.1","purlType":"apk","versions":[{"text":"< 25.7.3_git20260624-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.7.3_git20260624-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2026.1-fips","name":"openstack-horizon-2026.1-fips","label":"openstack-horizon-2026.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2026.1-fips","purlType":"apk","versions":[{"text":"< 25.7.3_git20260617-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.7.3_git20260617-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2025.1","name":"openstack-keystone-2025.1","label":"openstack-keystone-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2025.1","purlType":"apk","versions":[{"text":"< 27.0.1_git20260618-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 27.0.1_git20260618-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2025.1-fips","name":"openstack-keystone-2025.1-fips","label":"openstack-keystone-2025.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2025.1-fips","purlType":"apk","versions":[{"text":"< 27.0.1_git20260618-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 27.0.1_git20260618-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2025.2","name":"openstack-keystone-2025.2","label":"openstack-keystone-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2025.2","purlType":"apk","versions":[{"text":"< 28.0.1_git20260618-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 28.0.1_git20260618-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2025.2-fips","name":"openstack-keystone-2025.2-fips","label":"openstack-keystone-2025.2-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2025.2-fips","purlType":"apk","versions":[{"text":"< 28.0.1_git20260618-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 28.0.1_git20260618-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2026.1","name":"openstack-keystone-2026.1","label":"openstack-keystone-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2026.1","purlType":"apk","versions":[{"text":"< 29.0.1_git20260616-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 29.0.1_git20260616-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2026.1-fips","name":"openstack-keystone-2026.1-fips","label":"openstack-keystone-2026.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2026.1-fips","purlType":"apk","versions":[{"text":"< 29.0.1_git20260617-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 29.0.1_git20260617-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2025.1","name":"openstack-placement-2025.1","label":"openstack-placement-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2025.1","purlType":"apk","versions":[{"text":"< 13.0.0_git20260617-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.0.0_git20260617-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2025.1-fips","name":"openstack-placement-2025.1-fips","label":"openstack-placement-2025.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2025.1-fips","purlType":"apk","versions":[{"text":"< 13.0.0_git20260617-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.0.0_git20260617-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2025.2","name":"openstack-placement-2025.2","label":"openstack-placement-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2025.2","purlType":"apk","versions":[{"text":"< 14.0.0_git20260617-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 14.0.0_git20260617-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2025.2-fips","name":"openstack-placement-2025.2-fips","label":"openstack-placement-2025.2-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2025.2-fips","purlType":"apk","versions":[{"text":"< 14.0.0_git20260309-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 14.0.0_git20260309-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2026.1","name":"openstack-placement-2026.1","label":"openstack-placement-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2026.1","purlType":"apk","versions":[{"text":"< 15.0.0_git20260617-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.0.0_git20260617-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2026.1-fips","name":"openstack-placement-2026.1-fips","label":"openstack-placement-2026.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2026.1-fips","purlType":"apk","versions":[{"text":"< 15.0.0_git20260617-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.0.0_git20260617-r2","eol":null,"hubHref":null},{"vendor":"debian","product":"ujson","name":"ujson","label":"ujson","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/ujson","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 5.13.0-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 5.13.0-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"collada2gltf","name":"collada2gltf","label":"collada2gltf","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/collada2gltf","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"pandas","name":"pandas","label":"pandas","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/pandas","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"ujson","name":"ujson","label":"ujson","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/ujson","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"PyPI","product":"ujson","name":"ujson","label":"ujson","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/ujson","purlType":"pypi","versions":[{"text":"< 5.13.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.13.0","eol":null,"hubHref":null},{"vendor":"ultrajson_project","product":"ultrajson","name":"ultrajson","label":"ultrajson","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.13.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.13.0","eol":null,"hubHref":"/vendor/ultrajson_project/ultrajson"},{"vendor":"ultrajson","product":"ultrajson","name":"ultrajson","label":"ultrajson","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.13.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.13.0","eol":null,"hubHref":"/vendor/ultrajson/ultrajson"}],"affectedCount":32,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2","label":"github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","FIX","REPORT","Advisory","Mitigation","Patch","Vendor Advisory"]},{"url":"https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf","label":"github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","REPORT","Patch"]},{"url":"https://github.com/ultrajson/ultrajson/releases/tag/5.13.0","label":"github.com/ultrajson/ultrajson/releases/tag/5.13.0","hostname":"github.com","tags":["X Refsource MISC","WEB","Advisory","REPORT","Product","Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54911","label":"nvd.nist.gov/vuln/detail/CVE-2026-54911","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ujson/PYSEC-2026-2294.yaml","label":"github.com/pypa/advisory-database/tree/main/vulns/ujson/PYSEC-2026-2294.yaml","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/ultrajson/ultrajson","label":"github.com/ultrajson/ultrajson","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://ubuntu.com/security/CVE-2026-54911","label":"ubuntu.com/security/CVE-2026-54911","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54911","label":"www.cve.org/CVERecord?id=CVE-2026-54911","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54911","label":"security-tracker.debian.org/tracker/CVE-2026-54911","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54911.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54911.json","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-F367-HJWV-Q5GJ"]},"timeline":[{"kind":"published","date":"2026-06-22T20:53:07.019Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-23T14:20:13.488Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:35:11.391Z","stale":false,"partial":false}}