8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44660

CVE-2026-44660: UltraJSON has a Memory Leak in ujson.dump() on Write Failure

Summary

When ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload.

Code that uses ujson.dumps() rather than ujson.dump() or only JSON load/decode methods is unaffected.

Details

Vulnerability Location:

src/ujson/python/objToJSON.c:913 - objToJSONFile() function start
src/ujson/python/objToJSON.c:931 - Error return on write failure
src/ujson/python/objToJSON.c:942 - Early return without cleanup

Root Cause:

The objToJSONFile() function allocates a Python string object via ujson_dumps_internal(), calls the file's write() method, and returns early if write() raises an exception—but never calls Py_DECREF(string) on the early exit path.

PoC

import gc, tracemalloc, ujson

class BadFile:
    def write(self, s):
        raise RuntimeError("boom")

obj = {"x": "A" * 200000}

def run():
    try:
        ujson.dump(obj, BadFile())
    except RuntimeError:
        pass

run()
tracemalloc.start()
gc.collect()
base = tracemalloc.get_traced_memory()[0]

for i in range(5):
    run()
    gc.collect()
    cur = tracemalloc.get_traced_memory()[0]
    print(i, cur - base)

Impact

Any application that serializes data through ujson.dump() to an attacker-influenced file-like object that can fail can be driven into linear memory growth. An attacker can quickly use up all the memory of say a web server that sends JSON responses using ujson.dump() by repeatedly making requests then closing the connection mid response.

Remediation

The missing dec-refs were added in 82af1d0ac01d09aa40c887b460d44b9d9f4bccd9. We recommend upgrading to UltraJSON 5.12.1.

Workarounds

Replacing ujson.dump(obj, file) with file.write(ujson.dumps(obj)) is equivalent (contrary to popular misconception, there are no streaming benefits to using ujson.dump()) and will avoid the memory leak.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44660

CVE-2026-44660:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ujson	pip	<= 5.12.0	5.12.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the vulnerability started by examining the provided commit 82af1d0ac01d09aa40c887b460d44b9d9f4bccd9. The commit patch modifies the file src/ujson/python/objToJSON.c. The changes are within the C function objToJSONFile, which, based on the source code and vulnerability description, implements the ujson.dump() functionality for file-like objects. The patch explicitly adds memory deallocation calls (Py_DECREF(string)) in the error handling paths that are executed when a write to the file object fails. This directly confirms the vulnerability description, which states that a memory leak occurs on write failure. The vulnerable function exposed to the user and seen in runtime profiles is ujson.dump, which triggers the vulnerable C code path.

Vulnerable functions

ujson.dump

src/ujson/python/objToJSON.c

The vulnerability lies in the C function `objToJSONFile`, which is the implementation for the Python function `ujson.dump`. When `ujson.dump` is called with a file-like object, `objToJSONFile` is executed. If the `write()` method of the file-like object fails and raises an exception, the function would exit without releasing the memory allocated for the serialized JSON string. This leads to a memory leak. The patch corrects this by adding `Py_DECREF(string)` to the error-handling code paths, ensuring the memory is freed even when the write operation fails.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44660: UltraJSON has a Memory Leak in ujson.dump() on Write Failure

Summary

Details

PoC

Impact

Remediation

Workarounds

CVE-2026-44660:

8.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

8.7

8.7

CVE-2026-44660: UltraJSON has a Memory Leak in ujson.dump() on Write Failure

Summary

Details

PoC

Impact

Remediation

Workarounds

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI