Executive brief
UltraJSON, a high-speed JSON library for Python, contains a memory leak when writing data to certain types of files or network connections. If a write operation fails (for example, if a user closes a connection while a web server is sending a response), the memory used for that data is not released. An attacker could exploit this by repeatedly triggering failed writes to exhaust the server's memory, potentially causing the application to crash or become unavailable.
Technical details
A memory leak exists in UltraJSON's `objToJSONFile()` function within `src/ujson/python/objToJSON.c`. The function allocates a Python string object for serialized JSON data but fails to call `Py_DECREF()` if the subsequent `write()` call on the file-like object raises an exception. This results in a leak of the full serialized payload size for every failed write. An attacker can trigger this by inducing write failures, such as closing a network connection mid-response on a server using `ujson.dump()`. The issue is fixed in version 5.12.1. Applications using `ujson.dumps()` are unaffected.
Affected products
- UltraJSON ujson <= 5.12.0
Timeline
- 2026-05-07: disclosed: Initial disclosure on GitHub
- 2026-05-12: advisory: GitHub Advisory published
- 2026-05-27: other: NVD published date