CVE-2026-44660

HIGH EPSS 33.7%
Published May 27, 20261mo ago · Modified Jun 17, 20262w ago
8.7 CVSS 4.0
High
Find Similar
Published May 27, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago

Description

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.

CVSS Details

Base Score
8.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
33.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-401

Affected Products 1

VendorProductVersionRange
ultrajson_projectultrajson* <5.12.1

References 3

  • github.com https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9
    Patch
  • github.com https://github.com/ultrajson/ultrajson/releases/tag/5.12.1
    ProductRelease Notes
  • github.com https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg
    ExploitMitigationPatchVendor Advisory

Remediation

  • github.com https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9
    Patch
  • github.com https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg
    ExploitMitigationPatchVendor Advisory