Memory leak in ultrajson - CVE-2026-44660

Vulnerability identifier: #VU130990

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-44660

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after effective lifetime in the objToJSONFile() function when handling write failures in ujson.dump() to a file-like object. A remote attacker can trigger repeated failed write operations to cause a denial of service.

Each failed write leaks the full size of the serialized JSON payload.

ultrajson
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Fedora
SUSE Package Hub 15
Development Tools Module
openSUSE Leap
PowerVC
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
python-ujson-debuginfo
python3-ujson-debuginfo
python3-ujson
python-ujson-debugsource
python2-ujson-debuginfo
python2-ujson
python-ujson
python311-ujson

Install security update from vendor's website.

ultrajson - update to 5.12.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.4.0 Patch 3
python-ujson-debuginfo - update to 1.35-150100.3.13.1
python3-ujson-debuginfo - update to 1.35-150100.3.13.1
python3-ujson - update to 1.35-150100.3.13.1
python-ujson-debugsource - update to 1.35-150100.3.13.1
python2-ujson-debuginfo - update to 1.35-150100.3.13.1
python2-ujson - update to 1.35-150100.3.13.1
python-ujson - update to 5.8.0-5.el9
python311-ujson - update to 5.9.0-150600.3.3.1

• https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg
• https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9

• Memory leak in ultrajson
• Fedora EPEL 9 update for python-ujson
• SUSE update for python-ujson
• IBM PowerVC update for UltraJSON
• SUSE update for python-ujson
• IBM Watson Speech Services Cartridge update for UltraJSON