CVE-2026-44660CWE-401

UltraJSON: Memory Leak in ujson.dump() on Write Failure

High · published May 27, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00644 · 50.3th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-05-27T20:42Z
EPSS history
Timeline
  • 27 MAY 20:42Z
    UltraJSON: Memory Leak in ujson.dump() on Write Failure
    cvelistv5