Fluid Attacks Database

Description

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
pypi	ujson	>=0 <5.12.1	5.12.1
debian 11	ujson	=4.0.2-1 \|\| =4.2.0-1 \|\| =5.1.0-1 \|\| =5.10.0-1 \|\| =5.11.0-1 \|\| =5.11.0-2 \|\| =5.11.0-3 \|\| =5.2.0-1 \|\| =5.3.0-1 \|\| =5.4.0-1 \|\| =5.5.0-1 \|\| =5.5.0-2 \|\| =5.6.0-1 \|\| =5.7.0-1 \|\| =5.8.0-1 \|\| =5.9.0-1	-
debian 12	ujson	=5.10.0-1 \|\| =5.11.0-1 \|\| =5.11.0-2 \|\| =5.11.0-3 \|\| =5.7.0-1 \|\| =5.8.0-1 \|\| =5.9.0-1	-
debian 13	ujson	=5.10.0-1 \|\| =5.11.0-1 \|\| =5.11.0-2 \|\| =5.11.0-3	-
debian 14	ujson	=5.10.0-1 \|\| =5.11.0-1 \|\| =5.11.0-2 \|\| =5.11.0-3	-

Aliases

1. CVE-2026-446602. NVD-2026-446603. OSV-2026-446604. OSV-DEBIAN-2026-446605. GHSA-c38f-wx89-p2xg6. GCVE-2026-446607. SECURITY-TRACKER-CVE-2026-44660

References

1. https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg2. https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd93. https://github.com/ultrajson/ultrajson/releases/tag/5.12.1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.