CVE-2026-44660 Details
Description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.
A memory leak vulnerability has been identified in UltraJSON versions through 5.12.0. The issue arises in the ujson.dump() function when writing to a file-like object. If the write operation fails, the serialized JSON string is not properly cleaned up, leading to a memory leak. Each failed write operation causes a leak equivalent to the size of the serialized payload. This vulnerability is not present when using ujson.dumps() or the JSON load/decode methods.
Users are advised to upgrade to UltraJSON version 5.12.1, where this vulnerability has been fixed. The missing reference decrements were added in version 5.12.1.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg | CISA-ADP | ExploitMitigationPatchVendor Advisory |
| https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9 | [email protected] | Patch |
| https://github.com/ultrajson/ultrajson/releases/tag/5.12.1 | [email protected] | ProductRelease Notes |
| https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg | [email protected] | ExploitMitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ultrajson project ultrajson | < 5.12.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| May 30, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |