Junglewise Threat Intelligence

CVE-2026-44660: UltraJSON memory leak in ujson.dump on write failure

CVE-2026-44660 · Severity: high · CVSS 7.5 · Published 2026-05-27

Technologies: UltraJSON. Vendors: UltraJSON, PyPI.

Executive brief

UltraJSON, a high-speed JSON library for Python, contains a memory leak when writing data to certain types of files or network connections. If a write operation fails (for example, if a user closes a connection while a web server is sending a response), the memory used for that data is not released. An attacker could exploit this by repeatedly triggering failed writes to exhaust the server's memory, potentially causing the application to crash or become unavailable.

Technical details

A memory leak exists in UltraJSON's `objToJSONFile()` function within `src/ujson/python/objToJSON.c`. The function allocates a Python string object for serialized JSON data but fails to call `Py_DECREF()` if the subsequent `write()` call on the file-like object raises an exception. This results in a leak of the full serialized payload size for every failed write. An attacker can trigger this by inducing write failures, such as closing a network connection mid-response on a server using `ujson.dump()`. The issue is fixed in version 5.12.1. Applications using `ujson.dumps()` are unaffected.

Affected products

  • UltraJSON ujson <= 5.12.0

Timeline

  • 2026-05-07: disclosed: Initial disclosure on GitHub
  • 2026-05-12: advisory: GitHub Advisory published
  • 2026-05-27: other: NVD published date

References

Related threats