CVE-2026-44660 UltraJSON: Memory Leak in ujson.dump() on Write Failure
An attacker can cause memory exhaustion and denial of service by triggering write failures in ujson.dump(), affecting applications using the UltraJSON library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44660?
CVE-2026-44660 is a high-severity denial of service vulnerability in ultrajson, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.
Weakness: CWE-401
Which versions are affected by CVE-2026-44660?
3 open source packages ship an affected version, including ujson. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ujson PyPI | All versions | 5.12.1 |
ujson PyPI | All versions | 5.12.1 |
ujson PyPI | All versions | 5.12.1 |
Linux distribution packages (17)
python-ujson SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise Module for Development Tools 15 SP7 | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise Server 16.0 | All versions | 5.10.0-160000.3.1 |
python-ujson SUSE:Linux Enterprise Server 16.0 | All versions | 5.10.0-160000.3.1 |
python-ujson SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 1.35-150100.3.13.1 |
python-ujson SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 5.10.0-160000.3.1 |
python-ujson SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 5.10.0-160000.3.1 |
python-ujson openSUSE:Leap 16.0 | All versions | 5.10.0-160000.3.1 |
Products include Ultrajson Project Ultrajson.
How do I fix CVE-2026-44660?
Upgrade ujson to 5.12.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-44660 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44660 exists.
Other vulnerabilities in ultrajson
Sources
Also known as DEBIAN-CVE-2026-44660, ECHO-25c2-dc78-3aeb, GHSA-c38f-wx89-p2xg, MINI-m8jh-xqv7-hq36, PYSEC-2026-2293, SUSE-SU-2026:23114-1 and 4 more.