Vulnerability · Published May 27, 2026 · Assigned by GitHub_M
CVE-2026-44660UltraJSON: Memory Leak in ujson.dump() on Write Failure
High 8.7
In plain English
A high-severity memory leak in ultrajson from ultrajson. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ujson | no fix listed | DEBIAN-CVE-2026-44660 |
| Debian:13 | ujson | no fix listed | DEBIAN-CVE-2026-44660 |
| Debian:14 | ujson | 5.13.0-1 | DEBIAN-CVE-2026-44660 |
| PyPI | ujson | 5.12.1 | PYSEC-2026-2293 |
| PyPI | ujson | 5.12.1 | GHSA-c38f-wx89-p2xg |
| Ubuntu:22.04:LTS | collada2gltf | no fix listed | UBUNTU-CVE-2026-44660 |
| Ubuntu:22.04:LTS | pandas | no fix listed | UBUNTU-CVE-2026-44660 |
| Ubuntu:24.04:LTS | pandas | no fix listed | UBUNTU-CVE-2026-44660 |
| Ubuntu:25.10 | pandas | no fix listed | UBUNTU-CVE-2026-44660 |
| Ubuntu:26.04:LTS | pandas | no fix listed | UBUNTU-CVE-2026-44660 |
| Ubuntu:26.10 | pandas | no fix listed | UBUNTU-CVE-2026-44660 |
| Ubuntu:25.10 | ujson | no fix listed | UBUNTU-CVE-2026-44660 |
| Ubuntu:26.04:LTS | ujson | no fix listed | UBUNTU-CVE-2026-44660 |
| Ubuntu:26.10 | ujson | no fix listed | UBUNTU-CVE-2026-44660 |
Affected products (as reported)
Weakness: CWE-401 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N