CVE-2026-44660: UltraJSON Memory Leak on Write Failure in ujson.dump()

Background

UltraJSON, also known as ujson, is a high-performance JSON encoder and decoder for Python. It is designed to be faster than the standard library's JSON module, making it a popular choice for applications that require efficient JSON serialization and deserialization. However, a recent vulnerability has been identified in the ujson.dump() function, which can lead to memory leaks under certain conditions.

Vulnerability Detail

The vulnerability arises when the ujson.dump() function attempts to write serialized JSON data to a file-like object. If the write operation fails and raises an exception, the memory allocated for the serialized JSON string is not properly released, leading to a memory leak. This issue can cause applications to consume increasing amounts of memory, potentially resulting in denial of service as the application may exhaust available memory resources. The root cause is located in the objToJSONFile() function, where an early return on write failure does not decrement the reference count of the allocated string object.

pip install --upgrade "ujson==6.0.0"

pip install --upgrade "ujson==5.12.1"

Workaround

As a temporary workaround, you can replace the use of ujson.dump() with ujson.dumps() followed by a direct write to the file. Here is an example code snippet:

import ujson

class BadFile:
    def write(self, s):
        raise RuntimeError("boom")

obj = {"x": "A" * 200000}

try:
    with open('output.json', 'w') as f:
        f.write(ujson.dumps(obj))
except RuntimeError:
    pass

Conclusion

The identified vulnerability in UltraJSON (CVE-2026-44660) poses a significant risk due to memory leaks caused by failed write operations in the ujson.dump() function. It is crucial for developers using this library to upgrade to the patched version or implement the suggested workaround to mitigate the risk of memory exhaustion.

See every vulnerability recorded for ujson →

FAQ