Memory Leak Vulnerability in UltraJSON Library from UltraJSON

CVE-2026-44660

What is CVE-2026-44660?

UltraJSON, a widely-used JSON encoder and decoder written in C, contains a vulnerability that triggers memory leakage during write operations to file-like objects. When the method ujson.dump() encounters a write exception before completion, it does not decrease the size of the serialized JSON string, leading to significant memory allocation that is not released. This ongoing memory leak can degrade the performance of applications relying on the UltraJSON library. Users are encouraged to update to version 5.12.1 or later, where this issue has been addressed. For more details, please refer to the security advisory and the release notes.

References