CVE-2026-44660
Description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2026-44660 NameCVE-2026-44660 DescriptionUltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This…
CVE-2026-44660
| Name | CVE-2026-44660 |
| Description | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| ujson (PTS) | bullseye | 4.0.2-1 | vulnerable |
| bookworm | 5.7.0-1 | vulnerable | |
| trixie | 5.10.0-1 | vulnerable | |
| forky, sid | 5.11.0-3 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| ujson | source | (unstable) | (unfixed) |
Notes
https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg
Fixed by: https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9 (5.12.1)
Apply commands
https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xgFixed by: https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9 (5.12.1)OS impact
Debian Affected 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Affected | — |
| sid | Affected | — |
| forky | Affected | — |
| bullseye | Affected | — |
| bookworm | Affected | — |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| ultrajson_project | ultrajson | {"endExcluding":"5.12.1"} | 5.12.1 |
References
- https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg
- https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9
- https://github.com/ultrajson/ultrajson
- https://github.com/ultrajson/ultrajson/releases/tag/5.12.1
- https://github.com/advisories/GHSA-c38f-wx89-p2xg
- https://security-tracker.debian.org/tracker/CVE-2026-44660
CWEs
CWE-401
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.