The ujson.dumps(), ujson.dump(), and ujson.encode() functions in UltraJSON with reject_bytes=False improperly handle malformed or truncated UTF-8 byte sequences by silently rewriting invalid bytes into valid Unicode characters rather than rejecting them. This behavior breaks the expected equivalence between input bytes and the output of a dump-load cycle, leading to potential data integrity problems and validation bypass. The flaw was corrected by adding proper UTF-8 validation checks in commit 169eaf36b1116fece5034ee79a7a0ef3f6deedcf and is fixed in UltraJSON version 5.13.0.

Applications using ujson.dumps() with reject_bytes=False may experience data integrity issues due to silent rewriting of malformed UTF-8 sequences. Validation mechanisms that rely on byte-level checks before serialization can be bypassed, potentially allowing invalid or unexpected data to be processed or stored.

Upgrade UltraJSON to version 5.13.0 or later, where the UTF-8 validation issue is fixed. As a workaround, decode bytes to strings in Python before passing them to ujson.dumps() to avoid the vulnerability.