CVE-2026-44660
published 2026-05-27CVE-2026-44660: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.42%
34.6th percentile
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ujson | >= 0 < 5.12.1 | 5.12.1 |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| mta | mta-generic-external-provider-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-caikit-nlp-rhel9 | — | — |
| rhoai | odh-caikit-tgis-serving-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-trustyai-cpu-py312-rhel9 | — | — |
| satellite | iop-host-inventory-rhel9 | — | — |
| ultrajson | ultrajson | < 5.12.1 | 5.12.1 |
| ultrajson_project | ultrajson | < 5.12.1 | 5.12.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
UltraJSON has a Memory Leak in ujson.dump() on Write Failure
ghsa·2026-05-12
CVE-2026-44660 [HIGH] CWE-401 UltraJSON has a Memory Leak in ujson.dump() on Write Failure
UltraJSON has a Memory Leak in ujson.dump() on Write Failure
### Summary
When `ujson.dump()` writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload.
Code that uses `ujson.dumps()` rather than `ujson.dump()` or only JSON load/decode methods is unaffected.
### Details
**Vulnerability Location:**
- `src/ujson/python/objToJSON.c:913` - `objToJSONFile()` function start
- `src/ujson/python/objToJSON.c:931` - Error return on write failure
- `src/ujson/python/objToJSON.c:942` - Early return without cleanup
**Root Cause:**
The `objToJSONFile()` function allocates a Python string object via `ujson_dumps_internal()`, calls the file's
Red Hat
python-ujson: UltraJSON: Memory leak leading to Denial of Service
vendor_redhat·2026-05-27·CVSS 7.5
CVE-2026-44660 [HIGH] CWE-772 python-ujson: UltraJSON: Memory leak leading to Denial of Service
python-ujson: UltraJSON: Memory leak leading to Denial of Service
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.
A flaw was found in UltraJSON, a fast JSON encoder and decoder. When the `ujson.dump()` function attempts to write data to a file-like object and an error occurs during this operation, the memory allocated for the serialized JSON string is not properly released. This continuous failure to deallocate memory can lead to a memory leak, potentiall
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of Service [fedora-all]
bugzilla·2026-06-09·CVSS 7.5
CVE-2026-44660 [HIGH] CVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of Service [fedora-all]
CVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of Service [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
From https://www.cve.org/CVERecord?id=CVE-2026-44660, this is fixed in upstream release 5.12.1, which has already reached stable in all active Fedora branches.
Bugzilla
CVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of Service [epel-all]
bugzilla·2026-06-09·CVSS 7.5
CVE-2026-44660 [HIGH] CVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of Service [epel-all]
CVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of Service [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
From https://www.cve.org/CVERecord?id=CVE-2026-44660, this is fixed in upstream release 5.12.1, which has already reached stable in all active EPEL10 branches.
For EPEL9, python-ujson is at 5.8.0 due to breaking changes in 5.9.0, https://src.fedoraproject.org/rpms/python-ujson/pull-request/13. There are probably also some dependency issues involved in updating to the latest release, but it doesn’t matter, because I don’t think this CVE merits asking for an Updates
Bugzilla
CVE-2026-44660 python-pandas: UltraJSON: Memory leak leading to Denial of Service [fedora-all]
bugzilla·2026-06-09·CVSS 7.5
CVE-2026-44660 [HIGH] CVE-2026-44660 python-pandas: UltraJSON: Memory leak leading to Denial of Service [fedora-all]
CVE-2026-44660 python-pandas: UltraJSON: Memory leak leading to Denial of Service [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44660 python-pandas: UltraJSON: Memory leak leading to Denial of Service [epel-all]
bugzilla·2026-06-09·CVSS 7.5
CVE-2026-44660 [HIGH] CVE-2026-44660 python-pandas: UltraJSON: Memory leak leading to Denial of Service [epel-all]
CVE-2026-44660 python-pandas: UltraJSON: Memory leak leading to Denial of Service [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of Service
bugzilla·2026-05-27·CVSS 7.5
CVE-2026-44660 [HIGH] CVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of Service
CVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of Service
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.
https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9https://github.com/ultrajson/ultrajson/releases/tag/5.12.1https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xghttps://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg
2026-05-27
Published