Security readout for executives and security teams
Plain-English summary
UltraJSON versions before 5.4.0 can incorrectly parse malformed Unicode surrogate escapes in JSON. For businesses, the main concern is services that trust parsed JSON from outside sources: data may be corrupted, and dictionary values may be confused or overwritten.
Executive priority
Treat this as a high-priority dependency remediation for systems ingesting untrusted JSON. It is not evidenced as actively exploited here, but the affected component may sit in externally reachable data paths.
Technical view
The issue is in ujson decoding of escaped surrogate characters that are not valid surrogate pairs. Affected versions decode these incorrectly, creating potential string corruption, key confusion, and dictionary value overwrites. Version 5.4.0 changed behavior to preserve lone surrogates like Python's standard json module.
Likely exposure
Exposure is likely in Python applications using ultrajson/ujson below 5.4.0, especially APIs, webhooks, ingestion jobs, or services parsing JSON from untrusted sources. The provided sources do not identify affected downstream products beyond UltraJSON itself.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. Practical risk depends on whether attackers can supply JSON that an affected ujson parser consumes in security- or data-sensitive paths.
Researcher notes
Focus assessment on parser reachability and trust boundaries. The advisory names all users parsing JSON from untrusted sources as vulnerable, with no workaround besides upgrading. Evidence supports UltraJSON below 5.4.0 only.
Mitigation direction
- Upgrade UltraJSON/ujson to version 5.4.0 or later.
- Inventory Python lockfiles, images, and OS packages for ujson below 5.4.0.
- Prioritize services that parse JSON from users, partners, webhooks, or public APIs.
- If upgrade is delayed, check vendor guidance; sources state no known workaround.
- Run regression tests for JSON parsing behavior after upgrading.
Validation and detection
- Check SBOMs and dependency manifests for ultrajson or ujson versions below 5.4.0.
- Confirm the installed runtime package version in production images and hosts.
- Identify code paths using ujson to parse externally supplied JSON.
- Verify tests cover malformed Unicode handling and dictionary key preservation.
- Review Fedora or distribution package advisories where OS packages supply ujson.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-670: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-31116 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ultrajson/ultrajson/security/advisories/GHSA-wpqr-jcpx-745rCVE reference · x_refsource_CONFIRM
- https://github.com/ultrajson/ultrajson/commit/67ec07183342589d602e0fcf7bb1ff3e19272687CVE reference · x_refsource_MISC
- FEDORA-2022-1b2b8d5177CVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-33e816bc37CVE reference · vendor-advisory, x_refsource_FEDORA
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Always-Incorrect Control Flow Implementation
Always-Incorrect Control Flow Implementation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.